With much longer optimization time than that of untargeted attacks notwithstanding, the transferability of targeted attacks is still far from satisfactory. Recent studies reveal that fine-tuning an existing adversarial example (AE) in feature space can efficiently boost its targeted transferability. However, existing fine-tuning schemes only utilize the endpoint and ignore the valuable information in the fine-tuning trajectory. Noting that the vanilla fine-tuning trajectory tends to oscillate around the periphery of a flat region of the loss surface, we propose averaging over the fine-tuning trajectory to pull the crafted AE towards a more centered region. We compare the proposed method with existing fine-tuning schemes by integrating them with state-of-the-art targeted attacks in various attacking scenarios. Experimental results uphold the superiority of the proposed method in boosting targeted transferability. The code is available at github.com/zengh5/Avg_FT.

本研究针对目标攻击的转移性不足问题，提出了一种新方法，通过对微调轨迹进行平均处理，从而提高对抗样本的转移性。实验结果表明，该方法在不同攻击场景中相较于现有微调方案具有显著优势，展现了推动目标攻击性能提升的潜力。

两个脑袋总比一个好：通过平均微调来提高目标转移性