Abstract:Transfer-based attack adopts the adversarial examples generated on the surrogate model to attack various models, making it applicable in the physical world and attracting increasing interest. Recently, various adversarial attacks have emerged to boost adversarial transferability from different perspectives. In this work, inspired by the observation that flat local minima are correlated with good generalization, we assume and empirically validate that adversarial examples at a flat local region tend to have good transferability by introducing a penalized gradient norm to the original loss function. Since directly optimizing the gradient regularization norm is computationally expensive and intractable for generating adversarial examples, we propose an approximation optimization method to simplify the gradient update of the objective function. Specifically, we randomly sample an example and adopt a first-order procedure to approximate the curvature of Hessian/vector product, which makes computing more efficient by interpolating two neighboring gradients. Meanwhile, in order to obtain a more stable gradient direction, we randomly sample multiple examples and average the gradients of these examples to reduce the variance due to random sampling during the iterative process. Extensive experimental results on the ImageNet-compatible dataset show that the proposed method can generate adversarial examples at flat local regions, and significantly improve the adversarial transferability on either normally trained models or adversarially trained models than the state-of-the-art attacks. Our codes are available at: <a class="link-external link-https" href="https://github.com/Trustworthy-AI-Group/PGN" rel="external noopener nofollow">this https URL</a>.

Based on Max-Min Framework Transferable Adversarial Attacks

Bag of Tricks to Boost Adversarial Transferability

An Optimized Transfer Attack Framework Towards Multi-Modal Machine Learning

Admix: Enhancing the Transferability of Adversarial Attacks

Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attacks

Enhancing Transferability of Adversarial Examples Through Mixed-Frequency Inputs

Understanding and Enhancing the Transferability of Adversarial Examples

Enhancing Adversarial Transferability with Adversarial Weight Tuning

Boosting Adversarial Transferability by Block Shuffle and Rotation

Enhancing the Adversarial Transferability with Channel Decomposition

Improving Adversarial Transferability with Neighbourhood Gradient Information

Boost Adversarial Transferability by Uniform Scale and Mix Mask Method

Improving Adversarial Transferability by Stable Diffusion

Optimizing Latent Variables in Integrating Transfer and Query Based Attack Framework

Diversifying the High-level Features for better Adversarial Transferability

Towards Transferable Unrestricted Adversarial Examples with Minimum Changes

Enhancing the transferability of adversarial samples with random noise techniques

Improving Transferability of Adversarial Examples via Bayesian Attacks

Towards A Unified Min-Max Framework for Adversarial Exploration and Robustness

Boosting Adversarial Transferability by Achieving Flat Local Maxima

Transfer Attacks Revisited: A Large-Scale Empirical Study in Real Computer Vision Settings