The transferability of adversarial examples is of central importance to
transfer-based black-box adversarial attacks. Previous works for generating
transferable adversarial examples focus on attacking \emph{given} pretrained
surrogate models while the connections between surrogate models and adversarial
trasferability have been overlooked. In this paper, we propose {\em Lipschitz
Regularized Surrogate} (LRS) for transfer-based black-box attacks, a novel
approach that transforms surrogate models towards favorable adversarial
transferability. Using such transformed surrogate models, any existing
transfer-based black-box attack can run without any change, yet achieving much
better performance. Specifically, we impose Lipschitz regularization on the
loss landscape of surrogate models to enable a smoother and more controlled
optimization process for generating more transferable adversarial examples. In
addition, this paper also sheds light on the connection between the inner
properties of surrogate models and adversarial transferability, where three
factors are identified: smaller local Lipschitz constant, smoother loss
landscape, and stronger adversarial robustness. We evaluate our proposed LRS
approach by attacking state-of-the-art standard deep neural networks and
defense models. The results demonstrate significant improvement on the attack
success rates and transferability. Our code is available at
this https URL

提出了一种新颖的基于 Lipschitz 规正化的模拟模型（LRS）方法，用于转移性黑盒攻击中，通过改进模型参数以获得更好的攻击效果和转移性。研究还揭示了模拟模型的内在属性与转移性之间的关联，包括更小的局部 Lipschitz 常数、更平滑的损失曲面和更强的对抗鲁棒性。通过对现有深度神经网络和防御模型的攻击实验，结果表明使用 LRS 方法的攻击成功率和转移性显著提高。