Abstract:With the development of adversarial attacks, adversairal examples have been widely used to enhance the robustness of the training models on deep neural networks. Although considerable efforts of adversarial attacks on improving the transferability of adversarial examples have been developed, the attack success rate of the transfer-based attacks on the surrogate model is much higher than that on victim model under the low attack strength (e.g., the attack strength $\epsilon=8/255$). In this paper, we first systematically investigated this issue and found that the enormous difference of attack success rates between the surrogate model and victim model is caused by the existence of a special area (known as fuzzy domain in our paper), in which the adversarial examples in the area are classified wrongly by the surrogate model while correctly by the victim model. Then, to eliminate such enormous difference of attack success rates for improving the transferability of generated adversarial examples, a fuzziness-tuned method consisting of confidence scaling mechanism and temperature scaling mechanism is proposed to ensure the generated adversarial examples can effectively skip out of the fuzzy domain. The confidence scaling mechanism and the temperature scaling mechanism can collaboratively tune the fuzziness of the generated adversarial examples through adjusting the gradient descent weight of fuzziness and stabilizing the update direction, respectively. Specifically, the proposed fuzziness-tuned method can be effectively integrated with existing adversarial attacks to further improve the transferability of adverarial examples without changing the time complexity. Extensive experiments demonstrated that fuzziness-tuned method can effectively enhance the transferability of adversarial examples in the latest transfer-based attacks.

Foolmix: Strengthen the Transferability of Adversarial Examples by Dual-Blending and Direction Update Strategy

Boosting the Transferability of Adversarial Examples via Local Mixup and Adaptive Step Size

Admix: Enhancing the Transferability of Adversarial Attacks

Boost Adversarial Transferability by Uniform Scale and Mix Mask Method

Rethinking Mixup for Improving the Adversarial Transferability

Improving Transferable Targeted Attacks with Feature Tuning Mixup

Bag of Tricks to Boost Adversarial Transferability

Mixup Inference: Better Exploiting Mixup to Defend Adversarial Attacks.

Boosting the Targeted Transferability of Adversarial Examples via Salient Region & Weighted Feature Drop

Enhancing Transferability of Adversarial Examples Through Mixed-Frequency Inputs

Improving Transferability of Adversarial Examples With Input Diversity

Boosting Adversarial Transferability of MLP-Mixer

Understanding and Enhancing the Transferability of Adversarial Examples

Improving Adversarial Transferability by Stable Diffusion

Strengthening transferability of adversarial examples by adaptive inertia and amplitude spectrum dropout

Attention‐guided transformation‐invariant attack for black‐box adversarial examples

On the Adversarial Transferability of ConvMixer Models

AdvFoolGen: Creating Persistent Troubles for Deep Classifiers

Mist: Towards Improved Adversarial Examples for Diffusion Models

MixACM: Mixup-Based Robustness Transfer via Distillation of Activated Channel Maps

Fuzziness-tuned: Improving the Transferability of Adversarial Examples