Transfer-based attack adopts the adversarial examples generated on the
surrogate model to attack various models, making it applicable in the physical
world and attracting increasing interest. Recently, various adversarial attacks
have emerged to boost adversarial transferability from different perspectives.
In this work, inspired by the fact that flat local minima are correlated with
good generalization, we assume and empirically validate that adversarial
examples at a flat local region tend to have good transferability by
introducing a penalized gradient norm to the original loss function. Since
directly optimizing the gradient regularization norm is computationally
expensive and intractable for generating adversarial examples, we propose an
approximation optimization method to simplify the gradient update of the
objective function. Specifically, we randomly sample an example and adopt the
first-order gradient to approximate the second-order Hessian matrix, which
makes computing more efficient by interpolating two Jacobian matrices.
Meanwhile, in order to obtain a more stable gradient direction, we randomly
sample multiple examples and average the gradients of these examples to reduce
the variance due to random sampling during the iterative process. Extensive
experimental results on the ImageNet-compatible dataset show that the proposed
method can generate adversarial examples at flat local regions, and
significantly improve the adversarial transferability on either normally
trained models or adversarially trained models than the state-of-the-art
attacks.

本文提出一种新方法来生成攻击模型的对抗样本，该方法结合了平稳局部区域和梯度规范化来获得更好的迁移性，实验结果在 ImageNet 兼容数据集上表明此方法比现有的攻击方法能够更好地提高模型的迁移性。