English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

Adversarial examples (AEs) for DNNs have been shown to be transferable: AEsthat successfully fool white-box surrogate models can also deceive otherblack-box models with different architectures. Although a bunch of empiricalstudies have provided guidance on generating highly transferable AEs, many ofthese findings lack explanations and even lead to inconsistent advice. In thispaper, we take a further step towards understanding adversarialtransferability, with a particular focus on surrogate aspects. Starting fromthe intriguing little robustness phenomenon, where models adversarially trainedwith mildly perturbed adversarial samples can serve as better surrogates, weattribute it to a trade-off between two predominant factors: model smoothnessand gradient similarity. Our investigations focus on their joint effects,rather than their separate correlations with transferability. Through a seriesof theoretical and empirical analyses, we conjecture that the data distributionshift in adversarial training explains the degradation of gradient similarity.Building on these insights, we explore the impacts of data augmentation andgradient regularization on transferability and identify that the trade-offgenerally exists in the various training mechanisms, thus building acomprehensive blueprint for the regulation mechanism behind transferability.Finally, we provide a general route for constructing better surrogates to boosttransferability which optimizes both model smoothness and gradient similaritysimultaneously, e.g., the combination of input gradient regularization andsharpness-aware minimization (SAM), validated by extensive experiments. Insummary, we call for attention to the united impacts of these two factors forlaunching effective transfer attacks, rather than optimizing one while ignoringthe other, and emphasize the crucial role of manipulating surrogate models.

Why Does Little Robustness Help? Understanding and Improving Adversarial Transferability from Surrogate Training