The transferability of adversarial perturbations provides an effective
shortcut for black-box attacks. Targeted perturbations have greater
practicality but are more difficult to transfer between models. In this paper,
we experimentally and theoretically demonstrated that neural networks trained
on the same dataset have more consistent performance in
High-Sample-Density-Regions (HSDR) of each class instead of low sample density
regions. Therefore, in the target setting, adding perturbations towards HSDR of
the target class is more effective in improving transferability. However,
density estimation is challenging in high-dimensional scenarios. Further
theoretical and experimental verification demonstrates that easy samples with
low loss are more likely to be located in HSDR. Perturbations towards such easy
samples in the target class can avoid density estimation for HSDR location.
Based on the above facts, we verified that adding perturbations to easy samples
in the target class improves targeted adversarial transferability of existing
attack methods. A generative targeted attack strategy named Easy Sample
Matching Attack (ESMA) is proposed, which has a higher success rate for
targeted attacks and outperforms the SOTA generative method. Moreover, ESMA
requires only 5% of the storage space and much less computation time comparing
to the current SOTA, as ESMA attacks all classes with only one model instead of
seperate models for each class. Our code is available at
this https URL

在黑盒攻击中，敌对扰动的可迁移性为攻击提供了一种有效的捷径。本文实验和理论上证明相同数据集训练的神经网络，在每个类别的高样本密度区域（High-Sample-Density-Regions，HSDR）具有更一致的性能。在目标场景中，朝目标类别的 HSDR 添加扰动对于提高迁移性效果更好。此外，低损失的简单样本更有可能位于 HSDR，因此朝目标类别的这些简单样本添加扰动可以避免 HSDR 位置的密度估计。基于以上事实，我们验证了向目标类别的简单样本添加扰动可以提高现有攻击方法的目标敌对迁移性，提出了一种生成式目标攻击策略称为 Easy Sample Matching Attack（ESMA），它在目标攻击的成功率上具有更高的表现并且优于 SOTA 生成式方法。此外，与当前的 SOTA 相比，ESMA 只需 5% 的存储空间和更少的计算时间，因为 ESMA 使用单个模型攻击所有类别，而不是为每个类别分别创建模型。我们的代码可在此 URL 中获取。