Admix: Enhancing the Transferability of Adversarial Attacks

Understand

Deep neural networks are known to be extremely vulnerable to adversarial examples under white-box setting.

• Moreover, the malicious adversaries crafted on the surrogate (source) model often exhibit black-box transferability on other models with the same learning task but having different architectures.
• Recently, various methods are proposed to boost the adversarial transferability, among which the input transformation is one of the most effective approaches.
• We investigate in this direction and observe that existing transformations are all applied on a single image, which might limit the adversarial transferability.