Enhancing adversarial transferability via curvature-aware penalization.

Area of Science:

• Artificial Intelligence
• Machine Learning Security

Background:

• Transfer-based attacks generate adversarial examples on surrogate models, leveraging transferability to deceive unknown models.
• Optimizing loss surfaces via minimizing maximum loss is challenging due to non-linear landscapes in later attack stages.

Purpose of the Study:

• To propose a novel attack method, Curvature-Aware Penalization (CAP), to address the ineffectiveness of gradient ascent in later attack stages.
• To maintain the flatness of the loss surface during adversarial attack generation.

Main Methods:

• CAP incorporates gradient norm and curvature-aware terms as regularization to maintain loss surface flatness.
• Uses finite difference method to approximate the Hessian matrix, reducing computational cost.
• Averages stochastic gradient samples to reduce variance and approximate the Hessian.

Main Results:

• CAP crafts adversarial examples with enhanced transferability across diverse network architectures.
• The proposed CAP attack demonstrates stronger resistance against state-of-the-art adversarial defense methods.
• Experimental results validate the effectiveness of CAP in improving adversarial attack performance.

Conclusions:

• Curvature-Aware Penalization (CAP) offers an effective approach to generate more transferable and robust adversarial examples.
• The method improves upon existing techniques by addressing the non-linearity of loss landscapes in adversarial attacks.
• CAP provides a practical advancement in the field of adversarial machine learning and model security.