Making Substitute Models More Bayesian Can Enhance Transferability of Adversarial Examples

Understand

The transferability of adversarial examples across deep neural networks (DNNs) is the crux of many black-box attacks.

• Many prior efforts have been devoted to improving the transferability via increasing the diversity in inputs of some substitute models.
• In this paper, by contrast, we opt for the diversity in substitute models and advocate to attack a Bayesian model for achieving desirable transferability.
• Deriving from the Bayesian formulation, we develop a principled strategy for possible finetuning, which can be combined with many off-the-shelf Gaussian posterior approximations over DNN parameters.