Enhancing the Transferability of Adversarial Attacks through Variance Tuning

By Xiaosen Wang, Kun He. Computer Vision and Pattern Recognition, 2021

582 citations recorded by the source corpus.

Deep neural networks are vulnerable to adversarial examples that mislead the models with imperceptible perturbations. Though adversarial attacks have achieved incredible success rates in the white-box setting, most existing adversaries often exhibit weak transferability in the black-box setting, especially under the scenario of attacking models with defense mechanisms. In this work, we propose a new method called variance tuning to enhance the class of iterative gradient based attack methods and improve their attack transferability. Specifically, at each iteration for the gradient calculation, instead of directly using the current gradient for the momentum accumulation, we further consider the gradient variance of the previous iteration to tune the current gradient so as to stabilize the update direction and escape from poor local optima. Empirical results on the standard ImageNet dataset demonstrate that our method could significantly improve the transferability of gradient-based adversarial attacks. Besides, our method could be used to attack ensemble models or be integrated with various input transformations. Incorporating variance tuning with input transformations on iterative gradient-based attacks in the multi-model setting, the integrated method could achieve an average success rate of 90.1% against nine advanced defense methods, improving the current best attack performance significantly by 85.1% . Code is available at https://github.com/JHL-HUST/VT.

Subfields: Artificial Intelligence, Computer Vision and Pattern Recognition

View Paper: https://www.semanticscholar.org/paper/7301d58eb8a750e44b7da5ab0266b134d1651237

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Vision and Pattern Recognition

Citations in the corpus

Advances in adversarial attacks and defenses in computer vision: A survey (2021, background): “Targeted attacks on hashing based retrieval are proposed in [119], [261], whereas a universal perturbation for image retrieval systems is computed in [262].”
On Improving Adversarial Transferability of Vision Transformers (2021, methodology): “[31] improve momentum by using Nesterov momentum and variance tuning respectively during attack iterations, b) Augmentations: Xie et al.”
The TellTail of Embeddings: Fingerprinting Retrievers in Black-Box Systems (2026, unknown): “Interestingly, such poor transferability—often a “bug” limiting attack generalizability [16]–[19]—here becomes a “feature” serving the attacker: a query that succeeds only on the deployed model surfaces that model’s particularities, revealing its identity.”