Beyond Deceptive Flatness: Dual-Order Solution for Strengthening Adversarial Transferability

TL;DR

This paper introduces a novel dual-order gradient-based attack method that improves adversarial transferability by addressing deceptive flatness, with theoretical guarantees and enhanced sampling techniques, outperforming existing baselines on multiple datasets and attack scenarios.

Contribution

It proposes Adversarial Flatness (AF) and Adversarial Flatness Attack (AFA), providing a new perspective and theoretical assurance for transferability, along with MonteCarlo sampling for efficiency.

Findings

Outperforms six baselines on ImageNet-compatible dataset

Generates adversarial examples in flatter regions, boosting transferability

Effective against input transformation attacks and Baidu Cloud API

Abstract

Transferable attacks generate adversarial examples on surrogate models to fool unknown victim models, posing real-world threats and growing research interest. Despite focusing on flat losses for transferable adversarial examples, recent studies still fall into suboptimal regions, especially the flat-yet-sharp areas, termed as deceptive flatness. In this paper, we introduce a novel black-box gradient-based transferable attack from a perspective of dual-order information. Specifically, we feasibly propose Adversarial Flatness (AF) to the deceptive flatness problem and a theoretical assurance for adversarial transferability. Based on this, using an efficient approximation of our objective, we instantiate our attack as Adversarial Flatness Attack (AFA), addressing the altered gradient sign issue. Additionally, to further improve the attack ability, we devise MonteCarlo Adversarial Sampling (MCAS) by enhancing the inner-loop sampling efficiency. The comprehensive results on ImageNet-compatible dataset demonstrate superiority over six baselines, generating adversarial examples in flatter regions and boosting transferability across model architectures. When tested on input transformation attacks or the Baidu Cloud API, our method outperforms baselines.