LRS: Enhancing Adversarial Transferability through Lipschitz Regularized Surrogate

TL;DR

The work tackles limited transferability of adversarial examples in transfer-based black-box attacks by transforming surrogate models with Lipschitz regularization. It introduces two regularization schemes (LRS-1 on first-order loss and LRS-2 on second-order loss) and an extended LRS-F, all optimized via finite differences and applied as plug-ins to existing attacks. Empirical results on CIFAR-10 and ImageNet show substantial gains in attack success rates and transferability, attributed to smoother loss landscapes and reduced local Lipschitz constants; the approach also demonstrates robustness against defenses. The method provides new insights into the role of surrogate geometry in adversarial transferability and offers a practical, scalable way to enhance transfer-based attacks, with code released for reproducibility.

Abstract

The transferability of adversarial examples is of central importance to transfer-based black-box adversarial attacks. Previous works for generating transferable adversarial examples focus on attacking \emph{given} pretrained surrogate models while the connections between surrogate models and adversarial trasferability have been overlooked. In this paper, we propose {\em Lipschitz Regularized Surrogate} (LRS) for transfer-based black-box attacks, a novel approach that transforms surrogate models towards favorable adversarial transferability. Using such transformed surrogate models, any existing transfer-based black-box attack can run without any change, yet achieving much better performance. Specifically, we impose Lipschitz regularization on the loss landscape of surrogate models to enable a smoother and more controlled optimization process for generating more transferable adversarial examples. In addition, this paper also sheds light on the connection between the inner properties of surrogate models and adversarial transferability, where three factors are identified: smaller local Lipschitz constant, smoother loss landscape, and stronger adversarial robustness. We evaluate our proposed LRS approach by attacking state-of-the-art standard deep neural networks and defense models. The results demonstrate significant improvement on the attack success rates and transferability. Our code is available at https://github.com/TrustAIoT/LRS.

Figures (4)

• Figure 1: The loss landscape of original and transformed surrogate model: corrugated vs. smooth. Transformed surrogate models offer more stable input gradients and make the generated AE more generalizable, enabling more potent attacks.
• Figure 2: The loss of surrogate model (DenseNet) and target model (ResNet18), w.r.t. PGD-generated AE. It reveals that LRS-transformed models demonstrate more robustness and enable more transferable attacks.
• Figure 3: Ablation studies on average ASR under different hyperparameters $h$ and $\lambda$, the performance gains are consistent in a wide range of hyper-parameter values.
• Figure 4: Adversarial examples generated by our proposed LRS, showing that they are indistinguishable from original images by human eyes.

Theorems & Definitions (2)

• Definition 1
• Definition 2