Transfer-Based Adversarial Attack Method Using Combinations of Multiple Transformations

Deep neural networks are found to be attacked by adversarial examples easily. Those adversarial examples generated by adding subtle perturbations to clean images can mislead different models with their transferability, which makes (black-box) model more effective and practical, i.e., adversarial examples generated on a surrogate (white-box) model can also effectively attack a target (black-box) model. One effective strategy to improve the transferability of adversarial examples is input transformation. However, current input transformation methods utilize a single type of transformation limit in the diversity of data augmentation and the improvement of transferability. In this work, we propose a novel adversarial attack method, called the Multiple Transform Combination Attack Method (MTM), which incorporates increased types and quantity of image transformations. We first apply various image transformations to the input sample and its copies in each iteration, then calculate the gradients of these transformed images and averaged it and use this averaged gradient to generate adversarial examples with enhanced transferability. Extensive experiments on ImageNet demonstrate that adversarial examples generated using our method have significantly improved transferability whether on standard trained networks, adversarial trained networks, or advanced defense models.