Seeking Flat Minima Over Diverse Surrogates for Improved Adversarial Transferability: A Theoretical Framework and...

Area of Science:

• Artificial Intelligence
• Machine Learning Security
• Computer Vision

Background:

• Transfer-based black-box adversarial attacks aim to create adversarial examples (AEs) effective against unknown target models.
• Existing methods often lack theoretical rigor, relying on heuristic designs.
• Improving AE transferability is crucial for practical adversarial attacks.

Purpose of the Study:

• To develop a theoretically grounded method for enhancing adversarial example transferability.
• To provide provable guarantees for the effectiveness of adversarial attacks across different models.
• To propose a novel framework addressing limitations of previous transfer-attack strategies.

Main Methods:

• Derived a novel transferability bound with provable guarantees for adversarial transferability.
• Introduced a general transfer-based attack framework incorporating theoretical insights.
• Constructed a diverse surrogate model set to minimize adversarial model discrepancy.
• Developed a model-Diversity-compatible Reverse Adversarial Perturbation (DRAP) for AE flatness.

Main Results:

• Theoretical results demonstrate that optimizing AEs for flat minima and controlling model shift enhances transferability.
• The proposed framework integrates multiple factors contributing to AE transferability, unlike prior methods.
• DRAP effectively promotes AE flatness across diverse surrogate models, improving transferability.
• Experiments on NIPS2017 and CIFAR-10 datasets validated the proposed attack's effectiveness.

Conclusions:

• The novel theoretical bound provides a comprehensive guarantee for adversarial transferability.
• The proposed DRAP method significantly improves the transferability of adversarial examples.
• This work offers a theoretically sound and practically effective approach to transfer-based black-box adversarial attacks.