Improving Adversarial Transferability with Neighbourhood Gradient Information

TL;DR

This paper introduces NGI-Attack, a novel method that leverages neighbourhood gradient information to significantly improve the transferability of adversarial examples across models, especially against defenses.

Contribution

It proposes a new attack strategy using neighbourhood gradient information, Example Backtracking, and Multiplex Mask to enhance transferability without extra computational cost.

Findings

Achieves an average attack success rate of 95.2% against defense models.

Significantly improves transferability of adversarial examples.

Can be integrated with existing attack algorithms seamlessly.

Abstract

Deep neural networks (DNNs) are known to be susceptible to adversarial examples, leading to significant performance degradation. In black-box attack scenarios, a considerable attack performance gap between the surrogate model and the target model persists. This work focuses on enhancing the transferability of adversarial examples to narrow this performance gap. We observe that the gradient information around the clean image, i.e., Neighbourhood Gradient Information (NGI), can offer high transferability.Based on this insight, we introduce NGI-Attack, incorporating Example Backtracking and Multiplex Mask strategies to exploit this gradient information and enhance transferability. Specifically, we first adopt Example Backtracking to accumulate Neighbourhood Gradient Information as the initial momentum term. Then, we utilize Multiplex Mask to form a multi-way attack strategy that forces the network to focus on non-discriminative regions, which can obtain richer gradient information during only a few iterations. Extensive experiments demonstrate that our approach significantly enhances adversarial transferability. Especially, when attacking numerous defense models, we achieve an average attack success rate of 95.2%. Notably, our method can seamlessly integrate with any off-the-shelf algorithm, enhancing their attack performance without incurring extra time costs.