Enhance the Transferability from an Overfitting Perspective

Abstract

Deep neural networks perform best on a variety of collaborative computing tasks, but they are very susceptible to adversarial perturbations. Adversarial perturbations have been shown to be applicable in a variety of scenarios, and electronic data transmitted in the online world is highly vulnerable to adversarial examples. Adversarial attacks play a crucial role in robustness evaluation tests before deep neural networks are put to use. However, in the case where the attacker does not know the specific structure and parameters of the victim model, i.e., in the case of a black-box attack, the attacker can only deceive the victim model with a low success rate. The current black-box iterative attacks have two flaws. First, the iteration trajectories generated by existing attack methods lack diversity and adaptability. Second, insufficient efforts have been made to push adversarial examples towards incorrect classifications, which makes the adversarial examples not learn enough features of the wrong classification, resulting in lower transfer attack success rate. In this paper, we propose a scheme that can ameliorate these shortcomings. Our approach builds upon the Curls iteration, leveraging the Nesterov Accelerated Gradient method to accelerate gradient descent and introduce more diverse iteration trajectories. Additionally, to make the adversarial examples learn more features of the wrong classification, we further push the adversarial examples towards incorrect labels after successfully deceiving the model. Experimental results show that our scheme effectively enhances the transferability of generated adversarial examples across different network models.