Enhancing adversarial transferability via transformation inference

The transferability of adversarial examples has become a crucial issue in black-box attacks. Input transformation techniques have shown considerable promise in enhancing transferability, but existing methods are often limited by their empirical nature, neglecting the wide spectrum of potential transformations. This may limit the transferability of adversarial examples. To address this issue, we propose a novel transformation variational inference attack(TVIA) to improve the diversity of transformations, which leverages variational inference (VI) to explore a broader set of input transformations, thus enriching the diversity of adversarial examples and enhancing their transferability across models. Unlike traditional empirical approaches, our method employs the variational inference of a Variational Autoencoder (VAE) model to explore potential transformations in the latent space, significantly expanding the range of image variations. We further enhance diversity by modifying the VAE's sampling process, enabling the generation of more diverse adversarial examples. To stabilize the gradient direction during the attack process, we fuse transformed images with the original image and apply random noise. The experiment results on Cifar10, Cifar100, ImageNet datasets show that the average attack success rates (ASRs) of the adversarial examples generated by our TVIA surpass all existing attack methods. Specially, the ASR reaches 95.80 % when transferred from Inc-v3 to Inc-v4, demonstrating that our TVIA can effectively enhance the transferability of adversarial examples.