Abstract:Transferable adversarial attacks against Deep neural networks (DNNs) have received broad attention in recent years. An adversarial example can be crafted by a surrogate model and then attack the unknown target model successfully, which brings a severe threat to DNNs. The exact underlying reasons for the transferability are still not completely understood. Previous work mostly explores the causes from the model perspective, e.g., decision boundary, model architecture, and model capacity. Here, we investigate the transferability from the data distribution perspective and hypothesize that pushing the image away from its original distribution can enhance the adversarial transferability. To be specific, moving the image out of its original distribution makes different models hardly classify the image correctly, which benefits the untargeted attack, and dragging the image into the target distribution misleads the models to classify the image as the target class, which benefits the targeted attack. Towards this end, we propose a novel method that crafts adversarial examples by manipulating the distribution of the image. We conduct comprehensive transferable attacks against multiple DNNs to demonstrate the effectiveness of the proposed method. Our method can significantly improve the transferability of the crafted attacks and achieves state-of-the-art performance in both untargeted and targeted scenarios, surpassing the previous best method by up to 40% in some cases. In summary, our work provides new insight into studying adversarial transferability and provides a strong counterpart for future research on adversarial defense.

Improving Transferability of Adversarial Examples by Saliency Distribution and Data Augmentation

Boosting Transferability of Adversarial Samples Via Saliency Distribution and Frequency Domain Enhancement

Improving Adversarial Transferability by Stable Diffusion

Boosting the Targeted Transferability of Adversarial Examples via Salient Region & Weighted Feature Drop

Improving Transferability of Adversarial Examples With Input Diversity

Enhancing the Transferability of Adversarial Examples with Noise Injection Augmentation

Sample-analysis Based Adversarial Attack with Saliency Map

Improving the Transferability of Adversarial Samples by Path-Augmented Method

Improving Transferability of Adversarial Examples with Adversaries Competition

Improving Transferable Targeted Adversarial Attacks with Model Self-Enhancement

Crafting Transferable Adversarial Examples Via Contaminating the Salient Feature Variance

Evading Defenses to Transferable Adversarial Examples by Mitigating Attention Shift

Improving the Transferability of Adversarial Examples by Feature Augmentation

An Approach to Improve Transferability of Adversarial Examples

Toward Understanding and Boosting Adversarial Transferability from a Distribution Perspective

Generating Transferable Adversarial Examples from the Perspective of Ensemble and Distribution

Efficient Transferability of Generative Perturbations with Salient Feature Disruption and Adversarial Transformation

A Data-free Black-box Attack for Generating Transferable Adversarial Examples.

Strengthening transferability of adversarial examples by adaptive inertia and amplitude spectrum dropout

Improving Adversarial Transferability with Scheduled Step Size and Dual Example

Improving the Transferability of Adversarial Examples by Using Generative Adversarial Networks and Data Enhancement