Abstract:In practical black-box attack scenarios, most of the existing transfer-based attacks employ pretrained models (e.g. ResNet50) as the substitute models. Unfortunately, these substitute models are not always appropriate for transfer-based attacks. Firstly, these models are usually trained on a largescale annotated dataset, which is extremely expensive and time-consuming to construct. Secondly, the primary goal of these models is to perform a specific task, such as image classification, which is not developed for adversarial attacks. To tackle the above issues, i.e., high cost and over-fitting on taskspecific models, we propose an Affordable and Generalizable Substitute (AGS) training framework tailored for transferbased adversarial attack. Specifically, we train the substitute model from scratch by our proposed adversary-centric constrastive learning. This proposed learning mechanism introduces another sample with slight adversarial perturbations as an additional positive view of the input image, and then encourages the adversarial view and two benign views to interact comprehensively with each other. To further boost the generalizability of the substitute model, we propose adversarial invariant learning to maintain the representations of the adversarial example invariants under augmentations with various strengths. Our AGS model can be trained solely with unlabeled and out-of domain data and avoid overfitting to any task-specific models, because of its inherently self-supervised nature. Extensive experiments demonstrate that our AGS achieves comparable or superior performance compared to substitute models pretrained on the complete ImageNet training set, when executing attacks across a diverse range of target models, including ViTs, robustly trained models, object detection and segmentation models. Our source codes are available at https://github.com/lwmming/AGS.

A3GT: An Adaptive Asynchronous Generalized Adversarial Training Method

Attack As Defense: Characterizing Adversarial Examples Using Robustness.

GAAT: Group Adaptive Adversarial Training to Improve the Trade-Off Between Robustness and Accuracy

Improving Adversarial Robustness of 3D Point Cloud Classification Models

Bag of Tricks for FGSM Adversarial Training

Adversarial training via multi-guidance and historical memory enhancement

Gradient Band-based Adversarial Training for Generalized Attack Immunity of A3C Path Finding

FCGSM: Fast Conjugate Gradient Sign Method for Adversarial Attack on Image Classification

Practical Evaluation of Adversarial Robustness Via Adaptive Auto Attack.

A2: Efficient Automated Attacker for Boosting Adversarial Training

Improving the Generalization of Adversarial Training with Domain Adaptation

Enhancing Adversarial Robustness Via Anomaly-aware Adversarial Training.

Learn from the Past: A Proxy based Adversarial Defense Framework to Boost Robustness

GGT: Graph-Guided Testing for Adversarial Sample Detection of Deep Neural Network

GReAT: A Graph Regularized Adversarial Training Method

Robust Overfitting Does Matter: Test-Time Adversarial Purification With FGSM

AGS: Affordable and Generalizable Substitute Training for Transferable Adversarial Attack

Boosting Adversarial Training with Hardness-Guided Attack Strategy

An efficient adversarial example generation algorithm based on an accelerated gradient iterative fast gradient

Evaluation of GAN-Based Model for Adversarial Training

Dynamic Label Adversarial Training for Deep Learning Robustness Against Adversarial Attacks