Deep Neural Networks (DNNs) are widely acknowledged to be susceptible to
adversarial examples, wherein imperceptible perturbations are added to clean
examples through diverse input transformation attacks. However, these methods
originally designed for non-targeted attacks exhibit low success rates in
targeted attacks. Recent targeted adversarial attacks mainly pay attention to
gradient optimization, attempting to find the suitable perturbation direction.
However, few of them are dedicated to input transformation.In this work, we
observe a positive correlation between the logit/probability of the target
class and diverse input transformation methods in targeted attacks. To this
end, we propose a novel targeted adversarial attack called AutoAugment Input
Transformation (AAIT). Instead of relying on hand-made strategies, AAIT
searches for the optimal transformation policy from a transformation space
comprising various operations. Then, AAIT crafts adversarial examples using the
found optimal transformation policy to boost the adversarial transferability in
targeted attacks. Extensive experiments conducted on CIFAR-10 and
ImageNet-Compatible datasets demonstrate that the proposed AAIT surpasses other
transfer-based targeted attacks significantly.

本文提出了一种新的有针对性的对抗攻击方法，称为 AutoAugment Input Transformation (AAIT)，通过搜索最佳的转换策略，并利用找到的最佳转换策略来生成对抗样本，从而提升有针对性攻击中的对抗传递性能。通过在 CIFAR-10 和 ImageNet-Compatible 数据集上进行广泛实验，证明了所提出的 AAIT 方法明显优于其他基于传递性的有针对性攻击方法。