Boosting the Local Invariance for Better Adversarial Transferability
This work addresses the challenge of improving adversarial transferability for real-world attack scenarios, representing an incremental advancement by building on existing methods to enhance local invariance.
The paper tackled the problem of poor translation invariance in adversarial perturbations, which limits transferability across models, and proposed a Local Invariance Boosting (LI-Boost) technique that significantly boosted various transfer-based attacks on CNNs, ViTs, and defenses, as demonstrated through extensive experiments on ImageNet.
Transfer-based attacks pose a significant threat to real-world applications by directly targeting victim models with adversarial examples generated on surrogate models. While numerous approaches have been proposed to enhance adversarial transferability, existing works often overlook the intrinsic relationship between adversarial perturbations and input images. In this work, we find that adversarial perturbation often exhibits poor translation invariance for a given clean image and model, which is attributed to local invariance. Through empirical analysis, we demonstrate that there is a positive correlation between the local invariance of adversarial perturbations w.r.t. the input image and their transferability across different models. Based on this finding, we propose a general adversarial transferability boosting technique called Local Invariance Boosting approach (LI-Boost). Extensive experiments on the standard ImageNet dataset demonstrate that LI-Boost could significantly boost various types of transfer-based attacks (e.g., gradient-based, input transformation-based, model-related, advanced objective function, ensemble, etc.) on CNNs, ViTs, and defense mechanisms. Our approach presents a promising direction for future research in improving adversarial transferability across different models.