Staircase Sign Method for Boosting Adversarial Attacks

Qilong Zhang, Xiaosu Zhu, Jingkuan Song, Lianli Gao

Keywords: black-box, transferable perturbation, simple but effective, non-targeted&targeted attacks.

Abstract: Crafting adversarial examples for the transfer-based attack is challenging and remains a research hot spot. Currently, such attack methods are based on the hypothesis that the substitute model and the victim's model learn similar decision boundaries, and they conventionally apply Sign Method (SM) to manipulate the gradient as the resultant perturbation. Although SM is efficient, it only extracts the sign of gradient units but ignores their value difference, which inevitably leads to a serious deviation. Therefore, we propose a novel Staircase Sign Method (S$^2$M) to alleviate this issue, thus boosting transfer-based attacks. Technically, our method heuristically divides the gradient sign into several segments according to the values of the gradient units, and then assigns each segment with a staircase weight for better crafting adversarial perturbation. As a result, our adversarial examples perform better in both white-box and black-box manner without being more visible. Since S$^2$M just manipulates the resultant gradient, our method can be generally integrated into any transfer-based attacks, and the computational overhead is negligible. Extensive experiments on the ImageNet dataset demonstrate the effectiveness of our proposed methods, which significantly improve the transferability (i.e., on average, \textbf{5.1\%} for normally trained models and \textbf{11.2\%} for adversarially trained defenses). Our code is available in the supplementary material.

One-sentence Summary: Staircase Sign Method for enhancing both non-targeted and targeted transferability of adversarial examples

Community Implementations: [ 2 code implementations](https://www.catalyzex.com/paper/arxiv:2104.09722/code)