Improving Transferability of Adversarial Examples With Input Diversity

TLDR

CNNs are vulnerable to adversarial examples, yet most attacks achieve low success rates in black‑box settings. The authors aim to improve adversarial example transferability by generating diverse input patterns and to provide a strong benchmark for evaluating network robustness. They generate adversarial examples by applying random transformations to input images at each iteration, rather than using only the original images. Experiments on ImageNet demonstrate that the attack transfers significantly better to other networks, achieving a 73.0 % success rate that surpasses the top NIPS competition submission by 6.6 %. Code is available at https://github.com/cihangxie/DI-2-FGSM.

Abstract

Though CNNs have achieved the state-of-the-art performance on various vision tasks, they are vulnerable to adversarial examples --- crafted by adding human-imperceptible perturbations to clean images. However, most of the existing adversarial attacks only achieve relatively low success rates under the challenging black-box setting, where the attackers have no knowledge of the model structure and parameters. To this end, we propose to improve the transferability of adversarial examples by creating diverse input patterns. Instead of only using the original images to generate adversarial examples, our method applies random transformations to the input images at each iteration. Extensive experiments on ImageNet show that the proposed attack method can generate adversarial examples that transfer much better to different networks than existing baselines. By evaluating our method against top defense solutions and official baselines from NIPS 2017 adversarial competition, the enhanced attack reaches an average success rate of 73.0%, which outperforms the top-1 attack submission in the NIPS competition by a large margin of 6.6%. We hope that our proposed attack strategy can serve as a strong benchmark baseline for evaluating the robustness of networks to adversaries and the effectiveness of different defense methods in the future. Code is available at https://github.com/cihangxie/DI-2-FGSM.