Deep neural networks are vulnerable to adversarial examples, which are
crafted by adding human-imperceptible perturbations to original images. Most
existing adversarial attack methods achieve nearly 100% attack success rates
under the white-box setting, but only achieve relatively low attack success
rates under the black-box setting. To improve the transferability of
adversarial examples for the black-box setting, several methods have been
proposed, e.g., input diversity, translation-invariant attack, and
momentum-based attack. In this paper, we propose a method named Gradient
Refining, which can further improve the adversarial transferability by
correcting useless gradients introduced by input diversity through multiple
transformations. Our method is generally applicable to many gradient-based
attack methods combined with input diversity. Extensive experiments are
conducted on the ImageNet dataset and our method can achieve an average
transfer success rate of 82.07% for three different models under single-model
setting, which outperforms the other state-of-the-art methods by a large margin
of 6.0% averagely. And we have applied the proposed method to the competition
CVPR 2021 Unrestricted Adversarial Attacks on ImageNet organized by Alibaba and
won the second place in attack success rates among 1558 teams.

采用梯度修正的方法，可进一步提高对抗性转移性，通过对多个转换引入的无用梯度进行修正，我们的方法在 ImageNet 数据集上可以实现 82.07％的平均转移成功率，在单模型设置下胜过其他最先进的方法的平均 6.0％，并且我们已将所提出的方法应用于由阿里巴巴组织的 CVPR 2021 ImageNet 无限制对抗攻击比赛中，攻击成功率在 1558 支队伍中排名第二。