Abstract:Deep neural networks are known to be extremely vulnerable to adversarial examples under white-box setting. Moreover, the malicious adversaries crafted on the surrogate (source) model often exhibit black-box transferability on other models with the same learning task but having different architectures. Recently, various methods are proposed to boost the adversarial transferability, among which the input transformation is one of the most effective approaches. We investigate in this direction and observe that existing transformations are all applied on a single image, which might limit the adversarial transferability. To this end, we propose a new input transformation based attack method called Admix that considers the input image and a set of images randomly sampled from other categories. Instead of directly calculating the gradient on the original input, Admix calculates the gradient on the input image admixed with a small portion of each add-in image while using the original label of the input to craft more transferable adversaries. Empirical evaluations on standard ImageNet dataset demonstrate that Admix could achieve significantly better transferability than existing input transformation methods under both single model setting and ensemble-model setting. By incorporating with existing input transformations, our method could further improve the transferability and outperforms the state-of-the-art combination of input transformations by a clear margin when attacking nine advanced defense models under ensemble-model setting. Code is available at <a class="link-external link-https" href="https://github.com/JHL-HUST/Admix" rel="external noopener nofollow">this https URL</a>.

Adaptive Multi-scale Degradation-Based Attack for Boosting the Adversarial Transferability

Strengthening transferability of adversarial examples by adaptive inertia and amplitude spectrum dropout

Admix: Enhancing the Transferability of Adversarial Attacks

Improving Adversarial Transferability by Stable Diffusion

Enhancing Adversarial Transferability with Adversarial Weight Tuning

Adaptive Perturbation for Adversarial Attack

Enhancing the Adversarial Transferability with Channel Decomposition

Adaptive momentum variance for attention-guided sparse adversarial attacks

Based on Max-Min Framework Transferable Adversarial Attacks

ILA-DA: Improving Transferability of Intermediate Level Attack with Data Augmentation

Strong Transferable Adversarial Attacks via Ensembled Asymptotically Normal Distribution Learning

Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attacks

Nesterov Accelerated Gradient and Scale Invariance for Improving Transferability of Adversarial Examples.

Understanding and Enhancing the Transferability of Adversarial Examples

Enhancing Transferability of Adversarial Examples Through Mixed-Frequency Inputs

Improving Transferability of Adversarial Examples With Input Diversity

Evading Defenses to Transferable Adversarial Examples by Mitigating Attention Shift

An Optimized Transfer Attack Framework Towards Multi-Modal Machine Learning

Improving Adversarial Transferability with Neighbourhood Gradient Information

Boosting Black-box Adversarial Attack with a Better Convergence