Abstract:Adversarial example attacks are deemed to be a serious threat to deep neural network (DNN) models. Generating adversarial examples in white-box settings has been well-studied, however, it remains challenging to generate transferable adversarial examples that successfully attack black-box models. This work proposes Foolmix, a novel method for generating transferable adversarial examples for black-box attacks. The design of Foolmix is inspired by our observation that adversarial examples with high transferability usually carry multi-class features in the latent space of DNN models. Thus, we propose a dual-blending strategy that blends the image with a set of random pixel-blocks and blends the gradient by calculating the loss of the blended image for both the ground-truth label and a set of random labels. The dual-blending strategy pressures the example to penetrate multiple class regions and gain multi-class features in the latent space, greatly enhancing the transferability of the generated adversarial example. However, the randomness in the blending process might also pressure the example to approach the boundary of the original class region, which lowers the robustness of the example. To mitigate this problem, we further propose an update method in the starting forward direction to guide the generated adversarial example to go deep into multi-class adversarial regions while being globally far away from the original class region. Compared to state-of-the-art transformation-based attacks, Foolmix significantly enhances the transferability of generated adversarial examples, boosting the average transferable attack success rate by 13.2% and 16.9% on mainstream CNNs and ViTs respectively, while achieving better defense breakthrough ability.

Rethinking Mixup for Improving the Adversarial Transferability

Mixup Inference: Better Exploiting Mixup to Defend Adversarial Attacks.

Admix: Enhancing the Transferability of Adversarial Attacks

Boosting the Transferability of Adversarial Examples via Local Mixup and Adaptive Step Size

Boost Adversarial Transferability by Uniform Scale and Mix Mask Method

MixCam-attack: Boosting the Transferability of Adversarial Examples with Targeted Data Augmentation

Adversarial AutoMixup

TransMix: Attend to Mix for Vision Transformers

Foolmix: Strengthen the Transferability of Adversarial Examples by Dual-Blending and Direction Update Strategy

Improving Transferable Targeted Attacks with Feature Tuning Mixup

MixupE: Understanding and Improving Mixup from Directional Derivative Perspective

Boost Off/On-Manifold Adversarial Robustness for Deep Learning with Latent Representation Mixup.

TransMix: Crafting Highly Transferable Adversarial Examples to Evade Face Recognition Models

Enhancing Transferability of Adversarial Examples Through Mixed-Frequency Inputs

Understanding Mixup Training Methods

On the Adversarial Transferability of ConvMixer Models

Boosting Adversarial Transferability of MLP-Mixer

Decoupled Mixup for Data-efficient Learning

Bag of Tricks to Boost Adversarial Transferability

Mixup Without Hesitation

TransformMix: Learning Transformation and Mixing Strategies from Data