This paper substantially extends our work published at ECCV, in which an
intermediate-level attack was proposed to improve the transferability of some
baseline adversarial examples. Specifically, we advocate a framework in which a
direct linear mapping from the intermediate-level discrepancies (between
adversarial features and benign features) to prediction loss of the adversarial
example is established. By delving deep into the core components of such a
framework, we show that 1) a variety of linear regression models can all be
considered in order to establish the mapping, 2) the magnitude of the finally
obtained intermediate-level adversarial discrepancy is correlated with the
transferability, 3) further boost of the performance can be achieved by
performing multiple runs of the baseline attack with random initialization. In
addition, by leveraging these findings, we achieve new state-of-the-arts on
transfer-based $\ell_\infty$ and $\ell_2$ attacks. Our code is publicly
available at this https URL

该论文扩展了 ECCV 中提出的中级攻击的概念，并建立了一种中级差异到预测损失的直接线性映射框架，通过许多线性回归模型的考虑，发现对抗差异的大小与迁移性有关；在此基础上，使用随机初始化多次运行基线攻击可进一步提高性能，实现了基于转移的 l∞和 l2 攻击的新的最高水平。