Improving the Transferability of Adversarial Examples with Resized-Diverse-Inputs, Diversity-Ensemble and Region Fitting

About

We introduce a three stage pipeline: resized-diverse-inputs (RDIM), diversity-ensemble (DEM) and region fitting, that work together to generate transferable adversarial examples. We first explore the internal relationship between existing attacks, and propose RDIM that is capable of exploiting this relationship. Then we propose DEM, the multi-scale version of RDIM, to generate multi-scale gradients. After the first two steps we transform value fitting into region fitting across iterations. RDIM and region fitting do not require extra running time and these three steps can be well integrated into other attacks. Our best attack fools six black-box defenses with a 93% success rate on average, which is higher than the state-of-the-art gradient-based attacks. Besides, we rethink existing attacks rather than simply stacking new methods on the old ones to get better performance. It is expected that our findings will serve as the beginning of exploring the internal relationship between attack methods. Codes are available at https://github.com/278287847/DEM.

Junhua Zou, Zhisong Pan, Junyang Qiu, Xin Liu, Ting Rui, Wei Li · 2021

Related benchmarks

Task	Dataset	Result
Image Classification	CXR14	AUC0.78	82
Targeted Adversarial Attack	ImageNet-Compatible	Avg Success Rate61.7	73
Targeted Adversarial Attack	ImageNet	VGG-16 Score66.9	39
Targeted Adversarial Attack	ImageNet	Dense-121 Score5.2	31
Adversarial Attack Transferability	ImageNet-Compatible	Transferability on ViT100	29
Targeted Transfer Attack	ImageNet (val)	Attack Success Rate—	25
Targeted Adversarial Attack	ImageNet (val)	ViT Performance20	23
Adversarial Attack Transferability	ImageNet-compatible (test)	RN185.8	22
Adversarial Attack	ImageNet-Compatible	HGD Score0.8	19
Targeted Adversarial Attack	ImageNet (test)	Average Success Rate37	17