Boosting the Transferability of Adversarial Examples via Local Mixup and Adaptive Step Size

Adversarial examples are one critical security threat to various visual applications, where injected human-imperceptible perturbations confuse the output. Generating transferable adversarial examples in the black-box setting is crucial but challenging in practice. Existing input-diversity-based methods adopt different image transformations, but may be inefficient due to insufficient input diversity and an identical perturbation step size. Motivated by the fact that different image regions have distinctive weights in classification, this paper proposes a black-box adversarial generative framework by jointly designing enhanced input diversity and adaptive step sizes. We design local mixup to randomly mix a group of transformed adversarial images, strengthening the input diversity. For precise adversarial generation, we project the perturbation to relax the boundary constraint. Moreover, the step sizes of different regions can be dynamically adjusted by integrating a second-order momentum. Extensive experiments on ImageNet validate that our framework can achieve superior transferability compared to state-of-the-art baselines. Code is available at https://github.com/ZeroWalker10/IDAA.