Transfer-based adversarial attacks raise a severe threat to real-world deep
learning systems since they do not require access to target models. Adversarial
training (AT), which is recognized as the strongest defense against white-box
attacks, has also guaranteed high robustness to (black-box) transfer-based
attacks. However, AT suffers from heavy computational overhead since it
optimizes the adversarial examples during the whole training process. In this
paper, we demonstrate that such heavy optimization is not necessary for AT
against transfer-based attacks. Instead, a one-shot adversarial augmentation
prior to training is sufficient, and we name this new defense paradigm
Data-centric Robust Learning (DRL). Our experimental results show that DRL
outperforms widely-used AT techniques (e.g., PGD-AT, TRADES, EAT, and FAT) in
terms of black-box robustness and even surpasses the top-1 defense on
RobustBench when combined with diverse data augmentations and loss
regularizations. We also identify other benefits of DRL, for instance, the
model generalization capability and robust fairness.

该研究提出了一种名为数据中心稳健学习（DRL）的新的防御范例，通过在训练之前进行一次性的对抗性增强来提高对迁移攻击的稳健性，并且在黑盒稳健性上超过了多种常用的对抗训练技术。此外，DRL 还具有模型的泛化能力和稳健公平性。

面向数据中心强健学习的抵抗基于迁移的对抗性攻击的深度学习模型

Towards Deep Learning Models Resistant to Transfer-based Adversarial  Attacks via Data-centric Robust Learning

While the transferability property of adversarial examples allows the
adversary to perform black-box attacks (i.e., the attacker has no knowledge
about the target model), the transfer-based adversarial attacks have gained
great attention. Previous works mostly study gradient variation or image
transformations to amplify the distortion on critical parts of inputs. These
methods can work on transferring across models with limited differences, i.e.,
from CNNs to CNNs, but always fail in transferring across models with wide
differences, such as from CNNs to ViTs. Alternatively, model ensemble
adversarial attacks are proposed to fuse outputs from surrogate models with
diverse architectures to get an ensemble loss, making the generated adversarial
example more likely to transfer to other models as it can fool multiple models
concurrently. However, existing ensemble attacks simply fuse the outputs of the
surrogate models evenly, thus are not efficacious to capture and amplify the
intrinsic transfer information of adversarial examples. In this paper, we
propose an adaptive ensemble attack, dubbed AdaEA, to adaptively control the
fusion of the outputs from each model, via monitoring the discrepancy ratio of
their contributions towards the adversarial objective. Furthermore, an extra
disparity-reduced filter is introduced to further synchronize the update
direction. As a result, we achieve considerable improvement over the existing
ensemble attacks on various datasets, and the proposed AdaEA can also boost
existing transfer-based attacks, which further demonstrates its efficacy and
versatility.

通过自适应地控制每个模型输出的融合，监测其对于攻击目标的贡献差异比率，本文提出了一种自适应集成攻击（AdaEA）方法，并引入一个降低差异的滤波器以进一步同步更新方向，从而在各种数据集上取得了显著改进，同时能够提升已有的基于迁移的攻击方法，进一步证明了其高效性和多功能性。

一种用于提高对抗传递性的自适应模型集成对抗攻击方法

An Adaptive Model Ensemble Adversarial Attack for Boosting Adversarial  Transferability

Deep neural networks (DNNs) have been shown to be vulnerable to adversarial
examples. Moreover, the transferability of the adversarial examples has
received broad attention in recent years, which means that adversarial examples
crafted by a surrogate model can also attack unknown models. This phenomenon
gave birth to the transfer-based adversarial attacks, which aim to improve the
transferability of the generated adversarial examples. In this paper, we
propose to improve the transferability of adversarial examples in the
transfer-based attack via masking unimportant parameters (MUP). The key idea in
MUP is to refine the pretrained surrogate models to boost the transfer-based
attack. Based on this idea, a Taylor expansion-based metric is used to evaluate
the parameter importance score and the unimportant parameters are masked during
the generation of adversarial examples. This process is simple, yet can be
naturally combined with various existing gradient-based optimizers for
generating adversarial examples, thus further improving the transferability of
the generated adversarial examples. Extensive experiments are conducted to
validate the effectiveness of the proposed MUP-based methods.

本文提出基于屏蔽无关参数（MUP）的方法来提高转移型对抗攻击中对抗样本的传递性。通过使用基于泰勒展开的评估参数重要性得分的度量方法，并在生成对抗样本时屏蔽不重要的参数来优化先前的代理模型，可以很好地改善传递对抗攻击。通过广泛的实验，可以验证提出的基于 MUP 的方法的有效性。