Deep learning models are vulnerable to adversarial examples crafted by applying human-imperceptible perturbations on benign inputs. However, under the black-box setting, most existing adversaries often have a poor transferability to attack other defense models. In this work, from the perspective of regarding the adversarial example generation as an optimization process, we propose two new methods to improve the transferability of adversarial examples, namely Nesterov Iterative Fast Gradient Sign Method (NI-FGSM) and Scale-Invariant attack Method (SIM). NI-FGSM aims to adapt Nesterov accelerated gradient into the iterative attacks so as to effectively look ahead and improve the transferability of adversarial examples. While SIM is based on our discovery on the scale-invariant property of deep learning models, for which we leverage to optimize the adversarial perturbations over the scale copies of the input images so as to avoid "overfitting" on the white-box model being attacked and generate more transferable adversarial examples. NI-FGSM and SIM can be naturally integrated to build a robust gradient-based attack to generate more transferable adversarial examples against the defense models. Empirical results on ImageNet dataset demonstrate that our attack methods exhibit higher transferability and achieve higher attack success rates than state-of-the-art gradient-based attacks.

中文翻译：

---

Nesterov 加速梯度和对抗性攻击的尺度不变性

深度学习模型容易受到通过对良性输入应用人类无法察觉的扰动而制作的对抗性示例的影响。然而，在黑盒设置下，大多数现有对手往往具有较差的攻击其他防御模型的可转移性。在这项工作中，从将对抗样本生成作为优化过程的角度，我们提出了两种新方法来提高对抗样本的可迁移性，即 Nesterov 迭代快速梯度符号方法（NI-FGSM）和尺度不变攻击方法（ SIM）。NI-FGSM 旨在将 Nesterov 加速梯度应用到迭代攻击中，从而有效地向前看并提高对抗样本的可转移性。虽然 SIM 是基于我们对深度学习模型的尺度不变性的发现，为此，我们利用输入图像的比例副本来优化对抗性扰动，以避免在被攻击的白盒模型上“过度拟合”并生成更多可转移的对抗性示例。NI-FGSM 和 SIM 可以自然地集成以构建强大的基于梯度的攻击，以针对防御模型生成更多可转移的对抗性示例。ImageNet 数据集上的实证结果表明，与最先进的基于梯度的攻击相比，我们的攻击方法具有更高的可转移性和更高的攻击成功率。NI-FGSM 和 SIM 可以自然地集成以构建强大的基于梯度的攻击，以针对防御模型生成更多可转移的对抗性示例。ImageNet 数据集上的实证结果表明，与最先进的基于梯度的攻击相比，我们的攻击方法具有更高的可转移性和更高的攻击成功率。NI-FGSM 和 SIM 可以自然地集成以构建强大的基于梯度的攻击，以针对防御模型生成更多可转移的对抗性示例。ImageNet 数据集上的实证结果表明，与最先进的基于梯度的攻击相比，我们的攻击方法具有更高的可转移性和更高的攻击成功率。