Making Substitute Models More Bayesian Can Enhance Transferability of Adversarial Examples

TL;DR

This paper proposes a Bayesian approach to improve the transferability of adversarial examples across neural networks, significantly enhancing attack success rates by focusing on model diversity.

Contribution

It introduces a Bayesian model-based method for generating transferable adversarial examples, outperforming existing techniques and enabling further improvements when combined with recent methods.

Findings

Achieves roughly 19% increase in attack success rate on ImageNet.

Outperforms recent state-of-the-art methods by large margins.

Combining with other methods yields additional performance gains.

Abstract

The transferability of adversarial examples across deep neural networks (DNNs) is the crux of many black-box attacks. Many prior efforts have been devoted to improving the transferability via increasing the diversity in inputs of some substitute models. In this paper, by contrast, we opt for the diversity in substitute models and advocate to attack a Bayesian model for achieving desirable transferability. Deriving from the Bayesian formulation, we develop a principled strategy for possible finetuning, which can be combined with many off-the-shelf Gaussian posterior approximations over DNN parameters. Extensive experiments have been conducted to verify the effectiveness of our method, on common benchmark datasets, and the results demonstrate that our method outperforms recent state-of-the-arts by large margins (roughly 19% absolute increase in average attack success rate on ImageNet), and, by combining with these recent methods, further performance gain can be obtained. Our code: https://github.com/qizhangli/MoreBayesian-attack.