Enhancing adversarial transferability via transformation inference.

Area of Science:

• Artificial Intelligence
• Machine Learning Security
• Computer Vision

Background:

• Adversarial examples are crucial in black-box attacks, but their transferability is often limited.
• Existing input transformation methods are empirical and fail to explore diverse transformations.

Purpose of the Study:

• To propose a novel Transformation Variational Inference Attack (TVIA) to enhance adversarial example transferability.
• To improve the diversity of input transformations for more robust adversarial attacks.

Main Methods:

• Leveraging variational inference (VI) within a Variational Autoencoder (VAE) to explore a broader spectrum of input transformations.
• Modifying the VAE's sampling process to generate diverse adversarial examples.
• Fusing transformed images with original images and adding random noise to stabilize gradients.

Main Results:

• TVIA significantly enhances the diversity of adversarial examples.
• Experimental results on Cifar10, Cifar100, and ImageNet datasets show TVIA surpasses existing methods in attack success rates (ASRs).
• Achieved an ASR of 95.80% when transferring from Inc-v3 to Inc-v4.

Conclusions:

• TVIA effectively improves the transferability of adversarial examples across different models.
• The proposed method addresses limitations of empirical approaches by exploring a wider range of transformations.
• TVIA offers a promising direction for developing more potent black-box adversarial attacks.