LGV: Boosting Adversarial Example Transferability from Large Geometric Vicinity

Abstract

Transferability is the property of adversarial examples to be misclassified by other models than the surrogate model for which they were crafted. Previous research has shown that transferability is substantially increased when the training of the surrogate model has been early stopped. A common hypothesis to explain this is that the later training epochs are when models learn the non-robust features that adversarial attacks exploit. Hence, an early stopped model is more robust (hence, a better surrogate) than fully trained models.We demonstrate that the reasons why early stopping improves transferability lie in the side effects it has on the learning dynamics of the model. We first show that early stopping benefits transferability even on models learning from data with non-robust features. We then establish links between transferability and the exploration of the loss landscape in the parameter space, on which early stopping has an inherent effect. More precisely, we observe that transferability peaks when the learning rate decays, which is also the time at which the sharpness of the loss significantly drops.This leads us to propose RFN, a new approach for transferability that minimizes loss sharpness during training in order to maximize transferability. We show that by searching for large flat neighborhoods, RFN always improves over early stopping (by up to 47 points of transferability rate) and is competitive to (if not better than) strong state-of-theart baselines.

Preface: Celebrating the 70th Anniversary of School of Mechanical Science and Engineering, Huazhong University of Science and Technology

“…Attacking multiple surrogates from a sufficiently large geometry vicinity (LGV) improves transferability [22].…”

“…(1) Attacking an ensemble of surrogates in the distribution found by Bayes improves the transferability [21,31] (2) SAM can be seen as a relaxation of Bayes [41].…”

“…With a different perspective, another line of work [21,22,32,63] starts to examine the role of surrogate models. One useful observation is that attacking an ensemble of surrogate models with different architectures can obtain a more general update direction for AEs [5,35].…”

“…One useful observation is that attacking an ensemble of surrogate models with different architectures can obtain a more general update direction for AEs [5,35]. A recent study [22] also proposed fine-tuning a well-trained surrogate to obtain a set of intermediate models that can be used for an ensemble. However, it remains unclear which type of surrogate performs the best and should be included in the ensemble.…”

Boosting the Transferability of Adversarial Attacks with Reverse Adversarial Perturbation

“…However, they often overfit the surrogate models and thus exhibit poor transferability. Recently, many works have been proposed to generate more transferable adversarial examples [5,6,13,14,17,19,20,24,39,40,41,43,48], which we briefly summarize as below.…”