The transferability of adversarial examples can be exploited to launch
black-box attacks. However, adversarial examples often present poor
transferability. To alleviate this issue, by observing that the diversity of
inputs can boost transferability, input regularization based methods are
proposed, which craft adversarial examples by combining several transformed
inputs. We reveal that input regularization based methods make resultant
adversarial examples biased towards flat extreme regions. Inspired by this, we
propose an attack called flatness-aware adversarial attack (FAA) which
explicitly adds a flatness-aware regularization term in the optimization target
to promote the resultant adversarial examples towards flat extreme regions. The
flatness-aware regularization term involves gradients of samples around the
resultant adversarial examples but optimizing gradients requires the evaluation
of Hessian matrix in high-dimension spaces which generally is intractable. To
address the problem, we derive an approximate solution to circumvent the
construction of Hessian matrix, thereby making FAA practical and cheap.
Extensive experiments show the transferability of adversarial examples crafted
by FAA can be considerably boosted compared with state-of-the-art baselines.

通过加入平坦度感知的正则化项在优化目标中，以提高生成的对抗样本的平坦度，提高了对抗样本的可传递性，表现明显优于现有方法。