Comment on Transferability and Input Transformation with Additive Noise

TL;DR

This paper analyzes how input transformations with additive noise can enhance the transferability of adversarial examples across different neural network models, supported by mathematical proofs.

Contribution

It provides a mathematical analysis showing that certain input transformations can produce more transferable adversarial examples, advancing understanding of transferability.

Findings

Modified optimization increases transferability of adversarial examples

Mathematical proof supports the relationship between input noise and transferability

Enhances understanding of adversarial attack generalization

Abstract

Adversarial attacks have verified the existence of the vulnerability of neural networks. By adding small perturbations to a benign example, adversarial attacks successfully generate adversarial examples that lead misclassification of deep learning models. More importantly, an adversarial example generated from a specific model can also deceive other models without modification. We call this phenomenon ``transferability". Here, we analyze the relationship between transferability and input transformation with additive noise by mathematically proving that the modified optimization can produce more transferable adversarial examples.