Abstract:Transfer-based attack adopts the adversarial examples generated on the surrogate model to attack various models, making it applicable in the physical world and attracting increasing interest. Recently, various adversarial attacks have emerged to boost adversarial transferability from different perspectives. In this work, inspired by the observation that flat local minima are correlated with good generalization, we assume and empirically validate that adversarial examples at a flat local region tend to have good transferability by introducing a penalized gradient norm to the original loss function. Since directly optimizing the gradient regularization norm is computationally expensive and intractable for generating adversarial examples, we propose an approximation optimization method to simplify the gradient update of the objective function. Specifically, we randomly sample an example and adopt a first-order procedure to approximate the curvature of Hessian/vector product, which makes computing more efficient by interpolating two neighboring gradients. Meanwhile, in order to obtain a more stable gradient direction, we randomly sample multiple examples and average the gradients of these examples to reduce the variance due to random sampling during the iterative process. Extensive experimental results on the ImageNet-compatible dataset show that the proposed method can generate adversarial examples at flat local regions, and significantly improve the adversarial transferability on either normally trained models or adversarially trained models than the state-of-the-art attacks. Our codes are available at: <a class="link-external link-https" href="https://github.com/Trustworthy-AI-Group/PGN" rel="external noopener nofollow">this https URL</a>.

Promoting adversarial transferability with enhanced loss flatness

Boosting Adversarial Transferability by Achieving Flat Local Maxima

Transferable Adversarial Examples Based on Global Smooth Perturbations

Understanding and Enhancing the Transferability of Adversarial Examples

Boosting the Targeted Transferability of Adversarial Examples via Salient Region & Weighted Feature Drop

Enhancing Adversarial Transferability with Adversarial Weight Tuning

Improving Adversarial Transferability with Neighbourhood Gradient Information

Towards Transferable Unrestricted Adversarial Examples with Minimum Changes

Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attacks

Transferability Bound Theory: Exploring Relationship between Adversarial Transferability and Flatness

Enhancing the Transferability of Adversarial Examples with Noise Reduced Gradient

Bag of Tricks to Boost Adversarial Transferability

Rethinking the Backward Propagation for Adversarial Transferability

Boosting Adversarial Transferability by Block Shuffle and Rotation

Adaptive Perturbation for Adversarial Attack

Promoting Adversarial Transferability via Dual-Sampling Variance Aggregation and Feature Heterogeneity Attacks

LGV: Boosting Adversarial Example Transferability from Large Geometric Vicinity

Improved Forward-Backward Propagation To Generate Adversarial Examples

Improving Adversarial Transferability by Stable Diffusion

Boosting the Transferability of Adversarial Examples via Local Mixup and Adaptive Step Size