Flatness-aware Adversarial Attack

Mingyuan Fan, Xiaodan Li, Cen Chen, Yinggui Wang

Keywords: transfer-based attacks, adversarial attacks

TL;DR: We design a adversarial attack that can craft transferable adversarial examples by pushing them toward flatter regions.

Abstract: The transferability of adversarial examples can be exploited to launch black-box attacks. However, adversarial ones often present poor transferability. To alleviate this issue, by observing that the diversity of inputs can boost transferability, input regularization based methods are proposed, which craft adversarial ones by combining several transformed inputs. We reveal that input regularization based methods make resultant adversarial ones biased towards flat extreme regions. Inspired by this, we propose an attack called FAA which explicitly adds a flatness-aware regularization term in the optimization target to promote the resultant adversarial ones towards flat extreme regions. The flatness-aware regularization term involves gradients of samples around the resultant adversarial ones but optimizing gradients requires the evaluation of Hessian matrix in high-dimension spaces which generally is intractable. To address the problem, we derive an approximate solution to circumvent the construction of Hessian matrix, thereby making FAA practical and cheap. Extensive experiments show the transferability of adversarial ones crafted by FAA can be considerably boosted compared with state-of-the-art baselines.

Primary Area: societal considerations including fairness, safety, privacy

Code Of Ethics: I acknowledge that I and all co-authors of this work have read and commit to adhering to the ICLR Code of Ethics.

Submission Guidelines: I certify that this submission complies with the submission instructions as described on https://iclr.cc/Conferences/2024/AuthorGuide.

Anonymous Url: I certify that there is no URL (e.g., github page) that could be used to find authors' identity.

No Acknowledgement Section: I certify that there is no acknowledgement section in this submission for double blind review.

Submission Number: 684