Remix: Towards the transferability of adversarial examples

Area of Science:

• Computer Science
• Artificial Intelligence
• Machine Learning

Background:

• Deep neural networks (DNNs) are vulnerable to adversarial examples, which are subtle, human-imperceptible perturbations on images.
• Transfer-based black-box attacks are practical for assessing DNN vulnerability but often have unsatisfactory success rates.

Purpose of the Study:

• To enhance the transferability of adversarial examples in black-box attacks.
• To improve the practicality and success rates of attacks against DNN models.

Main Methods:

• Proposed a Remix method incorporating multiple input transformations.
• Utilized gradients from previous iterations and images from other categories for data augmentation.
• Conducted experiments on the NeurIPS 2017 adversarial and ILSVRC 2012 validation datasets.

Main Results:

• The Remix method significantly enhanced adversarial transferability.
• Maintained similar success rates compared to white-box attacks on both undefended and defended models.
• Experiments using LPIPS showed comparable perceived image distance to baseline methods.

Conclusions:

• The proposed Remix method effectively boosts adversarial transferability in DNNs.
• The approach offers a practical solution for improving black-box attack effectiveness while maintaining perceptual similarity.