Boosting Adversarial Transferability via Commonality-Oriented Gradient Optimization

TL;DR

This paper introduces a novel gradient optimization method called COGO that enhances the transferability of adversarial examples for Vision Transformers by focusing on shared features and suppressing individual model characteristics.

Contribution

The paper proposes COGO, a new strategy combining commonality enhancement and individuality suppression to improve adversarial transferability across models.

Findings

COGO significantly increases transfer success rates.

It outperforms existing state-of-the-art methods.

Effective in black-box attack scenarios.

Abstract

Exploring effective and transferable adversarial examples is vital for understanding the characteristics and mechanisms of Vision Transformers (ViTs). However, adversarial examples generated from surrogate models often exhibit weak transferability in black-box settings due to overfitting. Existing methods improve transferability by diversifying perturbation inputs or applying uniform gradient regularization within surrogate models, yet they have not fully leveraged the shared and unique features of surrogate models trained on the same task, leading to suboptimal transfer performance. Therefore, enhancing perturbations of common information shared by surrogate models and suppressing those tied to individual characteristics offers an effective way to improve transferability. Accordingly, we propose a commonality-oriented gradient optimization strategy (COGO) consisting of two components: Commonality Enhancement (CE) and Individuality Suppression (IS). CE perturbs the mid-to-low frequency regions, leveraging the fact that ViTs trained on the same dataset tend to rely more on mid-to-low frequency information for classification. IS employs adaptive thresholds to evaluate the correlation between backpropagated gradients and model individuality, assigning weights to gradients accordingly. Extensive experiments demonstrate that COGO significantly improves the transfer success rates of adversarial attacks, outperforming current state-of-the-art methods.