Transfer-based attacks generate adversarial examples on the surrogate model,
which can mislead other black-box models without any access, making it
promising to attack real-world applications. Recently, several works have been
proposed to boost adversarial transferability, in which the surrogate model is
usually overlooked. In this work, we identify that non-linear layers (e.g.,
ReLU, max-pooling, etc.) truncate the gradient during backward propagation,
making the gradient w.r.t.input image imprecise to the loss function. We
hypothesize and empirically validate that such truncation undermines the
transferability of adversarial examples. Based on these findings, we propose a
novel method called Backward Propagation Attack (BPA) to increase the relevance
between the gradient w.r.t. input image and loss function so as to generate
adversarial examples with higher transferability. Specifically, BPA adopts a
non-monotonic function as the derivative of ReLU and incorporates softmax with
temperature to smooth the derivative of max-pooling, thereby mitigating the
information loss during the backward propagation of gradients. Empirical
results on the ImageNet dataset demonstrate that not only does our method
substantially boost the adversarial transferability, but it also is general to
existing transfer-based attacks.

本文提出了一种新方法，即 Backward Propagation Attack（BPA），以增强与输入图像相关的梯度和损失函数之间的关联性，从而生成更具有传递性的对抗性样本，这在提高对真实世界应用的攻击中有很大的潜力。