Rethinking adversarial transferability from a random and average perspective

Abstract Deep learning models are vulnerable to adversarial examples generated by adding imperceptible perturbations to original images. Transfer-based adversarial attacks have attracted tremendous attention as they can utilize adversarial examples crafted on surrogate models to mislead target models. An effective strategy to boost adversarial transferability is to create diverse input patterns through input transformation. However, previous works rely on probability to control the diverse input patterns, ignoring the influence of randomness brought by probability on transferability. In this work, we rethink the randomness in these input transformation methods and identify the flaw of excessive randomness, which affects further improvement of transferability. From a statistical perspective, we propose a gradient average attack, which approximates the expected value of gradients by averaging multiple gradients, alleviating the impact of excessive randomness, and generating more transferable adversarial examples. Extensive experiments on the ImageNet dataset demonstrate that our method can remarkably enhance the input transformation attacks of multiple random transformation forms (e.g. resizing and padding, cropping, rotation, translation etc.) and gains heightened transferability. In addition, our method can be seamlessly incorporated with many existing attack methods to further achieve higher attack success rates. Moreover, when attacking a practical image recognition system on the Baidu AI Cloud, the 83.0% attack success rate reveals that real-world-implemented intelligent systems are subject to serious security threats.