Abstract:Deep neural networks are vulnerable to adversarial examples crafted by applying human-imperceptible perturbations on clean inputs. Although many attack methods can achieve high success rates in the white-box setting, they also exhibit weak transferability in the black-box setting. Recently, various methods have been proposed to improve adversarial transferability, in which the input transformation is one of the most effective methods. In this work, we notice that existing input transformation-based works mainly adopt the transformed data in the same domain for augmentation. Inspired by domain generalization, we aim to further improve the transferability using the data augmented from different domains. Specifically, a style transfer network can alter the distribution of low-level visual features in an image while preserving semantic content for humans. Hence, we propose a novel attack method named Style Transfer Method (STM) that utilizes a proposed arbitrary style transfer network to transform the images into different domains. To avoid inconsistent semantic information of stylized images for the classification network, we fine-tune the style transfer network and mix up the generated images added by random noise with the original images to maintain semantic consistency and boost input diversity. Extensive experimental results on the ImageNet-compatible dataset show that our proposed method can significantly improve the adversarial transferability on either normally trained models or adversarially trained models than state-of-the-art input transformation-based attacks. Code is available at: <a class="link-external link-https" href="https://github.com/Zhijin-Ge/STM" rel="external noopener nofollow">this https URL</a>.

Improving the Transferability of Adversarial Examples with Advanced Diversity-Ensemble Method

Improving the Transferability of Adversarial Examples with Resized-Diverse-Inputs, Diversity-Ensemble and Region Fitting

Improving Transferability of Adversarial Examples With Input Diversity

Boosting the Transferability of Adversarial Examples via Local Mixup and Adaptive Step Size

Boosting the Transferability of Ensemble Adversarial Attack via Stochastic Average Variance Descent

Diversity can be Transferred: Output Diversification for White- and Black-box Attacks

Improving the Transferability of Targeted Adversarial Examples through Object-Based Diverse Input

Improving Adversarial Transferability by Stable Diffusion

An Adaptive Model Ensemble Adversarial Attack for Boosting Adversarial Transferability

Admix: Enhancing the Transferability of Adversarial Attacks

Improving the Transferability of Adversarial Examples by Using Generative Adversarial Networks and Data Enhancement

Improving Adversarial Robustness Via Promoting Ensemble Diversity

Enhancing Cross-task Transferability of Adversarial Examples with Dispersion Reduction

Improving the Transferability of Adversarial Examples with Arbitrary Style Transfer

Improving Adversarial Robustness via Promoting Ensemble Diversity.

Enhancing the Transferability of Adversarial Attacks on Face Recognition with Diverse Parameters Augmentation

Boosting the Targeted Transferability of Adversarial Examples via Salient Region & Weighted Feature Drop

DVERGE: Diversifying Vulnerabilities for Enhanced Robust Generation of Ensembles

Diversifying the High-level Features for better Adversarial Transferability

Bag of Tricks to Boost Adversarial Transferability

Improving the Transferability of Adversarial Samples by Path-Augmented Method