GNP Attack: Transferable Adversarial Examples via Gradient Norm Penalty
This addresses the challenge of practical black-box attacks in adversarial machine learning, offering an incremental improvement by integrating with existing gradient-based methods.
The paper tackles the problem of adversarial examples overfitting to source models and lacking transferability to black-box targets, proposing Gradient Norm Penalty (GNP) to enhance transferability, which achieves high effectiveness when attacking 11 SOTA models and 6 defense methods.
Adversarial examples (AE) with good transferability enable practical black-box attacks on diverse target models, where insider knowledge about the target models is not required. Previous methods often generate AE with no or very limited transferability; that is, they easily overfit to the particular architecture and feature representation of the source, white-box model and the generated AE barely work for target, black-box models. In this paper, we propose a novel approach to enhance AE transferability using Gradient Norm Penalty (GNP). It drives the loss function optimization procedure to converge to a flat region of local optima in the loss landscape. By attacking 11 state-of-the-art (SOTA) deep learning models and 6 advanced defense methods, we empirically show that GNP is very effective in generating AE with high transferability. We also demonstrate that it is very flexible in that it can be easily integrated with other gradient based methods for stronger transfer-based attacks.