English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

Transferring adversarial examples (AEs) from surrogate machine-learning (ML)models to target models is commonly used in black-box adversarial robustnessevaluation. Attacks leveraging certain data augmentation, such as randomresizing, have been found to help AEs generalize from surrogates to targets.Yet, prior work has explored limited augmentations and their composition. Tofill the gap, we systematically studied how data augmentation affectstransferability. Particularly, we explored 46 augmentation techniques of sevencategories originally proposed to help ML models generalize to unseen benignsamples, and assessed how they impact transferability, when appliedindividually or composed. Performing exhaustive search on a small subset ofaugmentation techniques and genetic search on all techniques, we identifiedaugmentation combinations that can help promote transferability. Extensiveexperiments with the ImageNet and CIFAR-10 datasets and 18 models showed thatsimple color-space augmentations (e.g., color to greyscale) outperform thestate of the art when combined with standard augmentations, such as translationand scaling. Additionally, we discovered that composing augmentations impactstransferability mostly monotonically (i.e., more methods composed $\rightarrow$$\ge$ transferability). We also found that the best composition significantlyoutperformed the state of the art (e.g., 93.7% vs. $\le$ 82.7% averagetransferability on ImageNet from normally trained surrogates to adversariallytrained targets). Lastly, our theoretical analysis, backed up by empiricalevidence, intuitively explain why certain augmentations help improvetransferability.

The Ultimate Combo: Boosting Adversarial Example Transferability by Composing Data Augmentations