Towards Transferable Black-Box Attack via Minimizing Maximum Model Discrepancy

Adversarial attacks on black-box models, which operate without direct access to the target system, present a significant challenge due to the lack of a foundational theory for the transferability of adversarial examples. This paper introduces a paradigm shift in black-box adversarial attacks by minimizing model discrepancy. Our key insight is that adversarial transferability is fundamentally linked to the empirical attack error on the substitute model and the maximum model discrepancy among substitute models. We propose a new theory that provides a generalization error bound to analyze attack success on unseen models. Built on this new theory, we develop Minimizing Maximum Model Discrepancy (M3D), a novel framework that crafts adversarial examples with enhanced transferability and robustness against model variations. Our framework significantly boosts the success rate of black-box attacks, as evidenced by extensive experiments across two widely adopted datasets and various neural network architectures. Our algorithms consistently outperform state-of-the-art methods by a substantial margin. In some cases, our framework achieves over a 50$\%$ increase in both targeted and untargeted attack success rates compared with previous methods. The M3D framework enables more effective and reliable black-box attack strategies, setting a new benchmark for the field.