Transfer-based attacks generate adversarial examples on the surrogate model,
which can mislead other black-box models without any access, making it
promising to attack real-world applications. Recently, several works have been
proposed to boost adversarial transferability, in which the surrogate model is
usually overlooked. In this work, we identify that non-linear layers (e.g.,
ReLU, max-pooling, etc.) truncate the gradient during backward propagation,
making the gradient w.r.t.input image imprecise to the loss function. We
hypothesize and empirically validate that such truncation undermines the
transferability of adversarial examples. Based on these findings, we propose a
novel method called Backward Propagation Attack (BPA) to increase the relevance
between the gradient w.r.t. input image and loss function so as to generate
adversarial examples with higher transferability. Specifically, BPA adopts a
non-monotonic function as the derivative of ReLU and incorporates softmax with
temperature to smooth the derivative of max-pooling, thereby mitigating the
information loss during the backward propagation of gradients. Empirical
results on the ImageNet dataset demonstrate that not only does our method
substantially boost the adversarial transferability, but it also is general to
existing transfer-based attacks.

本文提出了一种新方法，即 Backward Propagation Attack（BPA），以增强与输入图像相关的梯度和损失函数之间的关联性，从而生成更具有传递性的对抗性样本，这在提高对真实世界应用的攻击中有很大的潜力。

重新思考针对对抗迁移的反向传播

Rethinking the Backward Propagation for Adversarial Transferability

Prior gradient-based attribution-map methods rely on handcrafted propagation
rules for the non-linear/activation layers during the backward pass, so as to
produce gradients of the input and then the attribution map. Despite the
promising results achieved, such methods are sensitive to the non-informative
high-frequency components and lack adaptability for various models and samples.
In this paper, we propose a dedicated method to generate attribution maps that
allow us to learn the propagation rules automatically, overcoming the flaws of
the handcrafted ones. Specifically, we introduce a learnable plugin module,
which enables adaptive propagation rules for each pixel, to the non-linear
layers during the backward pass for mask generating. The masked input image is
then fed into the model again to obtain new output that can be used as a
guidance when combined with the original one. The introduced learnable module
can be trained under any auto-grad framework with higher-order differential
support. As demonstrated on five datasets and six network architectures, the
proposed method yields state-of-the-art results and gives cleaner and more
visually plausible attribution maps.

提出使用可学习插件模块生成归因图的方法，用于在非线性层的反向传播过程中自动学习传播规则，该方法在五个数据集和六个网络架构上实现了最先进的结果。