Year: 2021

Abstract:
We consider adversarial attacks to a black-box model when no queries are allowed. In this setting, many methods directly attack surrogate models and transfer the obtained adversarial examples to fool the target model. Plenty of previous works investigated what kind of attacks to the surrogate model can generate more transferable adversarial examples, but their performances are still limited due to the mismatches between surrogate models and the target model. In this paper, we tackle this problem from a novel angle—instead of using the original surrogate models, can we obtain a Meta-Surrogate Model (MSM) such that attacks to this model can be easier transferred to other models? We show that this goal can be mathematically formulated as a well-posed (bi-level-like) optimization problem and design a differentiable attacker to make training feasible. Given one or a set of surrogate models, our method can thus obtain an MSM such that adversarial examples generated on MSM enjoy eximious transferability. Comprehensive experiments on Cifar-10 and ImageNet demonstrate that by attacking the MSM, we can obtain stronger transferable adversarial examples to fool black-box models including adversarially trained ones, with much higher success rates than existing methods.

heading: 1 INTRODUCTION
text: The developments of Convolutional Neural Network (CNN) (LeCun et al., 1995; Krizhevsky et al., 2012) have greatly promoted the advancements in Computer Vision (Ren et al., 2016). However, previous works (Goodfellow et al., 2014; Carlini & Wagner, 2017; Croce & Hein, 2020a; Ganeshan et al., 2019) have shown a critical robustness issue that CNN models are vulnerable to humanimperceptible perturbations of input images, also known as adversarial examples (AEs). The design of AEs is useful for revealing the security threats on machine learning systems (Croce & Hein, 2020b) and for understanding the representations learned by CNN models (Ilyas et al., 2019). In this paper, we consider the problem of black-box attack, where the target victim model is entirely hidden from the attacker. In this setting, standard white-box attacks (Moosavi-Dezfooli et al., 2016; Carlini & Wagner, 2017) or even query-based black-box attacks (Ilyas et al., 2018; Cheng et al., 2018; 2020; 2019) cannot be used, and the prevailing way to attack the victim is through transfer attack (Papernot et al., 2017; Wu et al., 2018). In transfer attack (Demontis et al., 2019; Dong et al., 2018), the attackers commonly generate AEs by attacking one or an ensemble of surrogate models and hope the obtained AEs can also successfully fool the victim black-box model. Although great efforts have been made to improve the transferability of adversarial attacks (Tramèr et al., 2017; Xie et al., 2019; Wu et al., 2020a), the transfer attack-based methods still encounter poor success rates, especially when attacking adversarially trained target models. This is caused by a fundamental limitation of current approaches—they all leverage the surrogate models trained by standard learning tasks (e.g., classification, object detection), while it is not always the case that attacks fooling such models can be easily transferred. We thus pose the following important question on transfer attack that has not been well studied in the literature: Instead of using standard (naturally trained) models as surrogate, can we artificially construct another Meta-Surrogate Model (MSM) such that attacks to this model can be easier transferred to other models? We answer this question in the affirmative by developing a novel black-box attack pipeline called Meta-Transfer Attack (MTA). Assume a set of source models (standard surrogate models) are given, instead of directly attacking these source models, our algorithm aims to obtain a “meta-surrogate
model (MSM)”, which is designed in the way that attacks to this model can be easier transferred to fool other models, and conduct attacks on the MSM to obtain transferable AEs. We show that this goal can be mathematically formulated as a well-posed (bi-level-like) training objective by unrolling the attacks on the MSM and defining a loss to measure the transferability of the resulting AEs. To avoid discrete operations in the white-box attack, we propose a Customized PGD attacker that enables back-propagation through the whole procedure. With this bi-level-like optimization (Finn et al., 2017; Qin et al., 2020), the source models supervise the MSM to improve the transferability of the AEs created on it. Through extensive experiments on various models and datasets, we show that the proposed MTA method leads to significantly improved transfer attacks, demonstrating the effectiveness of the MSM. We summarize the main contributions of our work as follows. 1) We propose a novel MTA framework to train an MSM to improve the transferability of AEs. To the best of our knowledge, our work is the first attempt to explore a better surrogate model for producing stronger transferable AEs. 2) We compare MTA with state-of-the-art transfer attack methods (e.g., MI (Dong et al., 2018), DI (Xie et al., 2019), TI (Dong et al., 2019), SGM (Wu et al., 2020a), AEG (Bose et al., 2020), IR (Wang et al., 2021a), SI-NI (Lin et al., 2020)) on Cifar-10 (Krizhevsky et al., 2009) and Imagenet (Deng et al., 2009). The comparisons demonstrate the effectiveness of the proposed MTA—the AEs generated by attacking MSM significantly outperform previous methods, in attacking both naturally trained and adversarially trained black-box target models.

heading: 2 BACKGROUND
text: Adversarial attacks. Szegedy et al. (2014) reveals the interesting phenomenon that CNN models are vunerable to adversarial attacks. After that, many attacks have been developed (Gao et al., 2020; Zhou et al., 2018; Wu et al., 2020b; Li et al., 2020b; Kaidi et al., 2019; Sriramanan et al., 2020). Adversarial attacks can be mainly classified into white-box and black-box attacks (Maksym et al., 2020) according to how much information about the target model is exposed to the attacker. Whitebox attacks (Kurakin et al., 2016) are often more effective than than black-box attacks (Brendel et al., 2017; Cheng et al., 2018; 2020) as they can leverage full knowledge of the target model including the model weights and architecture. For example, Fast Gradient Sign Method (FGSM) (Goodfellow et al., 2014) uses 1-step gradient ascent to produce adversarial examples that enlarge the model’s loss. Projected gradient descent (PGD) attack can be viewed as a multi-step FGSM attack (Madry et al., 2018). Many other white-box attacks have also been developed by leveraging full information of the target model (Moosavi-Dezfooli et al., 2016; Croce & Hein, 2020a). In the black-box setting, query-based black-box attacks (Huang & Zhang, 2020; Du et al., 2020) assume model information is hidden but attackers can query the model and observe the corresponding hard-label or soft-label predictions. Among them, (Chen et al., 2017; Ilyas et al., 2018) considered soft-label probability predictions and (Chen et al., 2020; Huang & Zhang, 2020; Cheng et al., 2018) considered hard-label decision-based predictions. Considering that using a large number of queries to attack an image is impractical, several works try to further reduce the query counts (Li et al., 2020a; Wang et al., 2020). Transferability of adversarial examples. In this paper, we consider the black-box attack scenario when the attacker cannot make any query to the target model (Lin et al., 2020; Huang et al., 2019; Wang et al., 2021b). In this case, the common attack method is based on transfer attack—the attacker generates AEs by attacking one or few surrogate models and hopes the AEs can also fool the target model (Papernot et al., 2016; Liu et al., 2017; Yuan et al., 2021; Zhou et al., 2018). Compared with query-based attacks, crafting AEs from the surrogate model consumes less computational resources and is more realistic in practice. Along this direction, subsequent works have made attempts to improve the transferability of AEs (Guo et al., 2020; Wu et al., 2020c; Naseer et al., 2019; Li et al., 2020c; Wang & He, 2021). For instance, Dong et al. (2018) boosted the transferability by integrating the momentum term into the iterative process. Other techniques like data augmentations (Xie et al., 2019), exploiting gradients of skip-connection (Wu et al., 2020a), and negative interaction between pixels (Wang et al., 2021a) also contribute to stronger transferable attacks. In addition to using the original surrogate models, AEG (Bose et al., 2020) adversarially trains a robust classifier together with an encoder-decoder-based transferable perturbation generator. After the training, AEG uses the generator to generate transferable AEs to attack a set of classifiers. Compared to all the existing works, our method is the first that meta-trains a new meta-surrogate model (MSM) such that attacks on MSM can be easier transferred to other models. This not only differs from all the previous methods that attack standard surrogate models but also differs from the encoder-decoder based method such as AEG (Bose et al., 2020).

heading: 3 METHODOLOGY
text: We consider the black-box attack setting where the target model is hidden to the attacker and queries are not allowed. This setting is also known as the transfer attack setting (Dong et al., 2018; 2019; Xie et al., 2019; Wang et al., 2021a) and the attacker 1) cannot access the weight, the architecture, and the gradient of the target model; and 2) cannot querying the target model. The attacker can access 1) the dataset used by the target model; and 2) a single or a set of surrogate models (also known as source models) that may share the dataset with the target model. For example, it is common to assume that the attacker can access one or multiple well-performed (pretrained) image classification models. Existing transferable adversarial attack methods conduct various attacks to these models and hope to get transferable AEs that can fool an unknown target model. Instead of proposing another attack method on surrogate models, we propose a novel framework MTA to train a Meta-Surrogate Model (MSM) with the goal that attacking the MSM can generate stronger transferable AEs than directly attacking the original surrogate models. When evaluating, the transferable AEs are generated by attacking the MSM with standard white-box attack methods (e.g., PGD attack). In the following, we will first review exiting attacks and then show how to form a bi-level optimization objective to train the MSM model.

heading: 3.1 REVIEWS OF FGSM AND PGD
text: We follow the settings of existing works (Dong et al., 2018; Xie et al., 2019; Wu et al., 2020a; Wang et al., 2021a) to focus on untargeted attack, where the attack is considered successful as long as the perturbed image is wrongly predicted.
FGSM (Goodfellow et al., 2014) conducts one-step gradient ascent to generate AEs to enlarge the prediction loss. The formulation can be written as
xadv = Clip ( x+ · sign(∇xL(f(x), y)) ) , (1)
where x is a clean image and y is the corresponding label; is the attack step size that determines the maximum L∞ perturbation of each pixel; f is the victim model that is transparent to the FGSM attacker; Clip is the function that clipping the values of xadv to the legal range (e.g., clipping the RGB AEs to the range of [0, 255]); L is usually the cross-entropy loss.
PGD (Kurakin et al., 2016), also known as I-FGSM attack, is a multi-step extension of FGSM. The formulation of PGD is
xkadv=Clip ( xk−1adv +
T · sign(∇xk−1adv L(f(x k−1 adv ), y))
) . (2)
xkadv is the AEs generated in the k-th gradient ascent step. Note that x 0 adv is the clean image equals to x. Eq 2 will be run for T iterations to obtain xTadv with perturbation size .

heading: 3.2 META-TRANSFER ATTACK
text: How to train the MSM where attacks to this model can be easier transferred to other models? We show this can be formulated as a bi-level training objective. Let A denote an attack algorithm (e.g., FGSM or PGD) and Mθ denote the MSM parameterized by θ. For a given image x, the AE generated by attackingMθ can be denoted as A(Mθ, x, y). For example, if A is FGSM, then A(Mθ, x, y) = xadv = Clip ( x+ · sign(∇xL(Mθ(x), y)) ) . Since in the attack time we only have access to a set of source models F1, . . . ,FN , we can evaluate the transferability of the adversarial example A(Mθ, x, y) on the source models and optimize the MSM via maximizing the adversarial losses of those N source models, leading to the following training objective:
argmax θ
E(x,y)∼D [∑N i=1 L(Fi( AE︷ ︸︸ ︷
A(Mθ, x, y))︸ ︷︷ ︸ F ′is prediction for AE
, y) ] , (3)
where D is the distribution of training data. The structure of this objective and the training procedure can be illustrated in Figure 1, where we can view it as a meta-learning or bi-level optimization method. At the lower level, the AE is generated by a white-box attack (usually gradient ascent) on MSM, while at the higher level, we feed the AE to the source models to compute the robust loss. Solving Eq 3 will find an MSM where attacking it leads to stronger transferable AEs. The optimization steps of Eq 3 are detailed below.
First, A should be some strong white-box attacks, such as FGSM or PGD. However, directly using those attacks will make the gradient of meta training objective Eq 3 ill-defined since the sign function in both FGSM and PGD introduce a discrete operation. This results in that the gradient back-propagating through sign be zero and further prohibits the training of the MSM.
𝐿  𝑥 , 𝑦
+ =
Source model   ℱ
Source model  ℱ
𝐿 ℱ 𝑥 , 𝑦
𝜖*𝐶𝑙𝑖𝑝
Optimizer
…
…
𝑥 𝑥𝐺
Meta‐surrogate  model 
(a)
𝐿 ℱ 𝑥 , 𝑦
To overcome this challenge, we design A as an approximation of PGD and denote it as Customized PGD. Section 3.3 will show more explanation about how the sign function in PGD prohibits backpropagation and how Customized PGD enables the back-propagation. The crucial difference between PGD and the Customized PGD is the operation to the gradient ∇xk−1adv L(Mθ(x k−1 adv ), y), where L is the cross entropy loss. For simplicity, we denote the vanilla gradient ∇xkadvL(Mθ(x k adv), y) at the k-th step as gk, and generate another map gkens via Eq 4: gk1 = gk sum(abs(gk)) gkt = 2 π · arctan( gk mean(abs(gk)) ) gks = sign(g k)
gkens = g k 1 + γ1 · gkt + γ2 · gks
(4)
Note that we set γ1 = γ2 = 0.01 as default for all the experiments. Both gk1 and g k t ensure the objective in Eq 3 be differentiable with respect to the MSM’s weight θ; arctan(·) is a smooth approximation of sign and 1mean(abs(gk)) prevents arctan from falling into the saturation or linear region. The item γ2 · gks provides the lower-bound for each pixel’s perturbation in gkens. The experiments in Section 4.3 will demonstrate the importances of gkt and g k s for Customized PGD. With Eq 4, the Customized PGD conducts the following update to generate AE: xkadv = Clip(x k−1 adv +
c T · gk−1ens ). (5)
Note that c differs from the perturbation in FGSM and PGD because gk−1ens in our update is not a sign vector and its size will depend on the magnitude of the original gradient. Finally, we get xTadv after T iterations of Eq 5.
Second, we feed xTadv into N source models and calculate the corresponding adversarial losses L(Fi(xTadv), y) for all i = 1, . . . , N . Larger losses of the N source models indicate a higher likelihood that xTadv fooling the MSM can transfer to other models.
Third, we optimize the MSM by maximizing the objective function defined in Eq 3. The update rule can be written as
θ ′ = θ + α · ∑N i=1∇θL(Fi(xTadv), y), (6)
where xTadv can be written as a function of θ by unrolling the attack update rule Eq 5 T times. We will show how to explicitly compute the gradient in Section 3.3. With this training procedure, the MSM is trained to learn a particular weight with which the white-box AEs fooling it can also fool other models. We summarize the training and testing of MTA in Algorithm 1 and Section A.1, respectively. Each capitalized notation represents a batch of the variable denoted with lower case. For example, X denotes a batch of x. Note that Customized PGD is just a continuous approximation of PGD used to train the MSM. In the inference phase, we use standard attacks such as PGD to craft AEs on the MSM.

heading: 3.3 GRADIENT CALCULATION
text: In the calculation we set both N and T in Eq 6 to 1, so the gradient in Eq 6 is ∇θL(F1(x1adv), y). According to Eq 5, we can replace x1adv in Eq 6 with Clip(x 0 adv + c · g0ens), where x0adv equals to x. For simplicity, we ignore the clip function in the analysis and simplify the derivation as ∇θL(F1(x+ c · g0ens), y). By chain rule and since x is independent to θ, we can further rewrite this
as ∂L(F1(x+ c · g0ens), y)
∂g0ens · ∂g
0 ens
∂θ . (7)
By replacing g0ens with Eq 4, the second term of Eq 7 can be expanded as
∇θg0ens = ∇θg01 + γ1 · ∇θg0t + γ2 · ∇θg0s . (8) Note that g0s equals to sign(g
0) and the sign function introduces discrete operation so that the gradient of g0s with respect to θ becomes 0 (unless g
0 = 0). Therefore, ∇θg0ens can be further written as ∇θg0ens = ∇θg01 + γ1 · ∇θg0t (9)
= ∇θ( ∇xL(Mθ(x), y)
sum(abs(∇xL(Mθ(x), Y ))) ) + γ1 · ∇θ(arctan( ∇xL(Mθ(x), y) mean(abs(∇xL(Mθ(x), y))) )).
In this formulation,∇xL(Mθ(x), y) depends on θ and the second-order derivative of∇xL(Mθ(x), y) w.r.t θ can be obtained with lots of deep learning libraries (Abadi et al., 2016; Paszke et al., 2017). In summary, by integrating Eqs.6-9, the MSM can be optimized by an SGD-based optimizer.
4 EXPERIMENT Algorithm 1 Training of Meta-Transfer Attack input: N source models F1, . . . ,FN , Training set D, batch size b, initialized MSMMθ. output: Optimized weight θ. 1 : while not done do 2 : sample data (X=[x1, . . . , xb], Y =[y1, . . . , yb]) ∈ D 3 : X0adv = X 4 : for k in [1, 2, ..., T]: 5 : Gk = ∇Xk−1adv L(Mθ(X k−1 adv ), Y )
6 : obtain Gkens via Eq 4 7 : obtain Xkadv via Eq 5 8 : end for 9 : for each source model Fi ∈ [F1,F2, . . . ,FN ], do 10: evaluate XTadv on Fi and obtain L(Fi(XTadv), Y ) 11: end for 12: θ = θ + α · ∇θ ∑N i L(Fi(XTadv), Y ) 13: return θ
We conduct experiments to show that the proposed method, under the same set of source models, can generate stronger transferable AEs than existing transfer attack methods.
We first present our general experimental settings. 1) We conduct experiments on both Cifar10 (Krizhevsky et al., 2009) and ImageNet (Deng et al., 2009). 2) We compare the proposed MTA with seven state-of-the-art transferable adversarial attack methods, including MI (Dong et al., 2018), DI (Xie et al., 2019), TI (Dong et al., 2019), SGM (Wu et al., 2020a), SI-NI (Lin et al., 2020), AEG (Bose et al., 2020), IR (Wang et al., 2021a), and FIA (Wang et al., 2021b). Note that since SGM is based on enlarging the gradient of skip connections, we only include this method on ImageNet experiments when the source models have sufficient skip connections. AEG is compared only on Cifar-10 because the official AEG is evaluated only on small scale datasets (Mnist and Cifar-10), and it is computational costly to train the perturbation generator on large-scale datasets. FIA is implemented only on ImageNet using the same intermediate feature layers introduces in (Wang et al., 2021b). 3) Since the number of attack iterations T is different between training and testing, we denote it as Tt in training and Tv in testing respectively to avoid confusion. 4) When training the MSM, we use the Customized PGD with γ1=γ2=0.01 to attack the MSM. When evaluating, we use PGD with Tv=10 and =15 to attack the MSM. 5) When using the baseline methods to generate AEs on multiple source models, we follow Dong et al. (2018) to ensemble the logits of the source models before loss calculation. 6) We use source and target models to train and to evaluate the MSM, respectively. 7) For fair comparisons between MTA and baselines, we implement baselines with the number of iterations T=10 and =15, and other hyper-parameters are tuned for their best possible performances (implementations are detailed in Section A.8). 8) More experiments (e.g., targeted transfer attack, attacks with smaller , more comparisons between MTA and baselines) will be shown in Section A.3.

heading: 4.1 EXPERIMENTS ON CIFAR-10

heading: 4.1.1 EXPERIMENTAL CONFIGURATIONS
text: On Cifar-10, we use 8 source models including ResNet-10, -18, -34 (He et al., 2016), SeResNet-14, -26, -50 (Hu et al., 2018), MobileNet-V1 (Howard et al., 2017), and -V2 (Sandler et al., 2018) to train the MSM. To ensure mismatches between the source and target models and to avoid saturated
transfer attack performances (i.e., attack success rates close to 100%), we select the 8 target models including MobileNet-V3 (Howard et al., 2019), ShuffleNet-V1, -V2 (Zhang et al., 2018), SqueezeNetA, -B (Iandola et al., 2016), and adversarially trained ResNet-18, -34, and SeResNet-50. The network architectures of all 16 models are defined on public GitHub repositories1,2,3. We train all the source and target models and describe the training details of these models in Section A.2. The trained models and the code will be released to the community for reproducibility. Training the MSM. The default network architecture of the MSM is ResNet-13 shown in Figure 2, with M1, M2, M3, and M4 set to 64, 128, 256, and 512, respectively. We use the 8 source models to train the MSM for 60 epochs with the number of attack steps Tt of 7. c of the Customized PGD is initialized to 1,600 and is exponentially decayed by 0.9× for every 4,000 iterations. The learning rate α and the batch size are set to 0.001 and 64, respectively. Evaluating the MSM. On each target model, we only attack the correctly classified test images because attacking wrongly classified clean images is less meaningful.

heading: 4.1.2 EXPERIMENTAL RESULTS
text: Table 1 shows the experimental results. The recently proposed white-box attack method APGD (Croce & Hein, 2020b) is also treated as a compared method here. Apparently, MTA performs much better than all the previous methods with significantly increased transfer attack success rates. For example, compared with IR (Wang et al., 2021a), MTA improves the success rates by 54.8%, 26.3%, 45.4%, 32.5%, 35.7%, 23.3%, 30.9%, and 34.7% on the eight target models. The results of MTAγ1=0, MTAγ2=0, and MTAdense will be discussed in ablation study (Section 4.3).
1https://github.com/yxlijun/cifar-tensorflow 2https://github.com/TropComplique/ShuffleNet-tensorflow 3https://github.com/TropComplique/shufflenet-v2-tensorflow

heading: 4.2 EXPERIMENTS ON IMAGENET

heading: 4.2.1 EXPERIMENTAL CONFIGURATIONS
text: We directly use the public trained ImageNet models4,5,6 including ResNet-50, -101, -152 (He et al., 2016), DenseNet-121, -161 (Huang et al., 2017), Inception-V3 (Szegedy et al., 2016), -V4 (Szegedy et al., 2017), Inception-ResNet-V2, Inception-V3ens3, Inception-V3ens4, and Inception-ResNetV2ens. The former eight models are normally trained models while the latter three are secure models trained by ensemble adversarial training (Tramèr et al., 2017). We shorten these models as Res-50, Res-101, Res-152, DN-121, DN-161, Inc-V3, Inc-V4, IncRes-V2, Inc-V3ens3, Inc-V3ens4, and IncRes-V3ens.
Training the MSM. The default network architecture of the MSM is ResNet-19 shown in Figure 2, with M1, M2, M3, and M4 set to 32, 80, 200, and 500, respectively. We follow previous works (Dong et al., 2018; Wu et al., 2020a) to evaluate the transferability of AEs in two settings: using a single source model and using multiple source models. We set the input resolution of the MSM to 224×224. Note that, when the resolution of the source model differs from that of the MSM, we resize the AE xTadv to the resolution of the source model before feeding it into the source model. More details about training the MSM will be shown in Section A.4.
Evaluating the MSM. Following the official testing data settings in the papers of DI (Xie et al., 2019) and SGM (Wu et al., 2020a), we also randomly choose 5,000 validation images from ImageNet that are correctly classified by all models for evaluation. Note that, when the resolutions of the MSM and the target model are different, we resize the AE xTadv to the resolution of the target model. For instance, when attacking Inc-V3 whose resolution is 299×299, we first resize xTadv from 224×224 to 299×299 and then use the resized xTadv to attack Inc-V3.
4https://github.com/pudae/tensorflow-densenet 5https://github.com/tensorflow/models/tree/r1.12.0/research/slim 6https://github.com/tensorflow/models/tree/r1.12.0/research/adv imagenet models

heading: 4.2.2 USING ONE SOURCE MODEL
text: Table 2 reports the experimental results of using one source model. Note that, in this work, we only focus on the transfer attack testing scene and neglect the white-box attack testing scene. So we left the results of the testing scenes where the target model is the source model itself to /. MI-DI is a combination of MI and DI. IR is our re-implementation with =15 and the implementation details will be shown in Section A.8. Obviously, MTA outperforms the baselines on almost all testing scenes with great margins, especially when attacking adversarially trained models. For example, compared with FIA, MTA improves the transfer attack success rates by about 31.7%, 30.7%, 41.1%, 131.1%, 41.9%, and 75.2% when using the Inc-V3 source model and attacking the target models (Inc-V4, IncRes-152, Res-152, Inc-V3ens3, Inc-V3ens4, IncRes-V2ens). MTA-IR combines MTA with IR. Instead of attacking the MSM using PGD, MTA-IR generates AEs by attacking the MSM using IR. Compared with MTA, MTA-IR improves the attack success rates by about 5.1%, 6.8%, 14.7%, 23.3%, 44.8%, and 55.9% when using the Inc-V3 source model and attacking the target models, indicating that existing transferable attack methods can further improve MTA.
Recall that SGM only works for source models with lots of skip connections (e.g., ResNet). And the original paper sets to 16, which differs from most of the other methods. The official IR also sets to 16. Therefore, we copy their results with = 16 from their official paper to Table 2 and denote them as SGM∗ =16 and IR ∗ =16, respectively. To compare MTA with them, we further set to 16 for MTA and denote the new result as MTA =16. The comparisons show that MTA =16 outperforms SGM∗ =16 and IR∗ =16 significantly.
When using IncRes-V2 source model, MTA sometimes performs slightly worse than MI-DI, possibly because the MSM with ResNet-19 backbone is not suitable to be trained to attack IncRes-V2. We then replace the backbone from ResNet-19 with another simplified Inception network (the architecture will be shown in Section A.6) and retrain the MSM. The newly trained MSM is denoted as MTAInc. Compared with ResNet-19, the simplified Inception backbone is more similar to IncRes-V2 so that MTAInc turns to be easier to generate adversarial attacks to fool IncRes-V2 than MTA, leading to easier convergence of MTAInc. The experimental results show that MTAInc outperforms not only MTA but also the compared methods in most testing scenes, indicating 1) the advantage of the proposed MTA framework and 2) MTA can be further improved by using more suitable backbones.

heading: 4.2.3 USING MULTIPLE SOURCE MODELS
text: The experimental results of using multiple source models are reported in Table 3. We use three source model groups (Res-50+Res-152+DN161, Res-50+Inc-V1+DN-121, Res-50+Inc-V1) to train the MSM, respectively, and use seven target models (Inc-V3, Inc-V4, InvRes-V2, Res-101, Inc-V3ens3,
Inc-V3ens4, IncRes-V2ens) to evaluate the transferability of the attacks to the MSM. SGM-X is the combination of SGM and X (X=DI or MI). TI-DI is the combination of TI and DI, which is also known as TI-DIM (Dong et al., 2019). The results show that MTA outperforms the baselines in almost all testing scenes, especially when attacking defensive models. For instance, compared with SGM-DI, MTA improves the transfer attack success rates by 6.2%, 25.8%, 14.1%, 2.2%, 26.5%, 45.5%, and 96.1% on the seven target models when using Res-50 and Inc-V1 source models. Besides, MTA-IR outperforms MTA.

heading: 4.3 ABLATION STUDY
text: Network structure The comparison between MTA and MTAInc shown in Table 2 has validated the effect of backbone on the MSM. Here we conduct another experiment on Cifar-10 to further verify the effect of backbone by replacing the backbone from ResNet-13 to DenseNet-22BC (the structure of DenseNet-22BC will be shown in Section A.6). We denote the MSM using DenseNet-22BC backbone as MTAdense and report its experimental results in Table 1. The comparisons among MTA, MTAdense, and the other compared methods indicate that 1) the backbone affects the performance of MTA; 2) MTA outperforms the compared methods with various backbones. This also inspires us to design more suitable backbones to improve MTA as future work.
Number of attack iterations We perform several experiments on Cifar-10 to validate how the number of attack iterations Tt affects the performance. Tt is set to 7 by default on Cifar-10. Here we set Tt to 1, 3, 5, 9, and 11 and keep all the other settings be consistent with the default settings. Figure 3 shows the corresponding performances of MTA. It is observed that when Tt < 7, the performances of MTA will be improved with the increase of Tt while when Tt > 7, the performance tends to drop. We think this is due to the difficulty of unrolling too many attack steps when training the MSM. We also verify how Tv affects the performance by changing Tv. Tv is default set to 10 in all our experiments. Figure 3 shows the experimental results using different numbers of Tv. When Tv = 1, the performances can be denoted as MTA-FGSM (one-step PGD). With the increase of Tv, the transfer attack success rates are clearly increased.
The effects of γ1 and γ2 We perform two experiments on Cifar-10 to verify how the parameters γ1 and γ2 in Eq 5 affect the transfer attack performance. In the two experiments, we set γ1 and γ2 to zero respectively, and amplify c appropriately to offset the decrease of the training perturbation size caused by zeroing γ1 or γ2. We denote the two newly performed MTA as MTAγ1=0 and MTAγ2=0. Table 1 shows the experimental results. The results show that by setting γ1
to zero, the performances of MTA are greatly damaged on all target models, indicating the indispensability of the arctan component in the Customized PGD. Setting γ2 to zero also decreases MTA’s performances, but the effect is much smaller than that of γ1. Overall, the two experiments demonstrate the indispensability of Customized PGD for the proposed MTA framework. Further, both the arctan and sign components in Customized PGD are important to train the MSM, especially arctan.

heading: 5 CONCLUSION
text: Existing query free black-box adversarial attack methods directly use image classification models as surrogate models to generate transferable adversarial attacks to attack black-box models neglecting the study of surrogate models. In this paper, we propose a novel framework called meta-transfer attack (MTA) to improve the transferability of adversarial attacks via training an MSM using these surrogate models. The MSM is a particular model trained to learn how to make the adversarial attacks to it can fool the surrogate models. To enable and improve the training of the MSM, a novel Customized PGD is also developed. Through extensive experiments, we validate that by attacking the trained MSM, we can get transferable adversarial attacks that are generalizable to attack black-box target models with much higher success rates than existing methods, demonstrating the effectiveness of the proposed MTA framework.

heading: 6 ETHICS STATEMENT
text: Our work is promising to evaluate and improve the security of deep models, and has no potential negative societal impacts.

heading: 7 REPRODUCIBILITY STATEMENT
text: We provide our code in supplemental material and describe all the experimental settings in Sections 4.1.1, 4.2.1, and Appendix. The hyperparameter settings and the network structure are clear. The training details of source and target models used on Cifar-10 are described in Section A.2, and the network architecture descriptions of these models can be found in Section 4.1.1 and our code. The source and target models used on ImageNet can be found in the repositories described in Section 4.2.1. We include a very simple code example of our method at the end of Appendix, which also helps readers to understand and to reproduce our results. Overall, our work is easy to reproduce and follow.

heading: A APPENDIX

heading: A.1 TESTING PSEUDO CODE OF MTA
text: We summarize the testing pseudo code of MTA in Algorithm.2, where F̂ is the target model and ỹ is the target model’s prediction for the adversarial example xTadv . Note that all the clean examples in D̂ are correctly classified by the target model. Len(D̂) denotes the number of examples in D̂.

heading: A.2 TRAINING THE SOURCE AND TARGET MODELS ON CIFAR-10
text: Algorithm 2 Testing of Meta-Transfer Attack input: Black-box target model F̂ , Testing examples D̂ that are correctly classified by the target model, Optimized metasurrogate modelMθ. output: Transfer attack success rate. 1 : P = 0 2 : for (x, y) ∈ D̂ do 3 : x0adv = x 4 : for k in [1, 2, ..., T] do 5 : gk = ∇xk−1adv L(Mθ(x k−1 adv ), y)
6 : xkadv=Clip ( xk−1adv + T · sign(g k) ) 7 : end for 8 : evaluate xTadv on F̂ and obtain ỹ = F̂(xTadv) 9 : if y 6= ỹ do 10: P+ = 1 11: end if 12: return P
Len(D̂) On Cifar-10, we use 16 source and target models to train and test the metasurrogate model (MSM). The 8 source models are ResNet-10, -18, -34, SeResNet-14, -26, -50, MobileNetV1, and -V2. The 8 target models are MobileNet-V3, ShuffleNet-V1, -V2, SqueezeNet-A, -B, and adversarially trained ResNet-18, -34 and SeResNet50. It is not easy to collect the 16 trained Cifar-10 models on the internet. Therefore, before the experiments of MTA, we first use consistent hyperparameters to train the 16 models on Cifar-10 for 200 epochs. The learning rate, L2 weight decay, and batch size are set to 0.01, 1e-5, and 128, respectively. For each adversarially trained model, we first use FGSM and the normally trained model to generate one adversarial example for each training image with = 3, and then train the model on both clean and adversarial images. The 8 source models obtain 90.0%, 91.8%, 92.6%, 85.6%, 88.3%, 90.5%, 82.0%, and 81.8% accuracies on the test set, and the 8 target models obtain 80.0%, 82.5%, 76.4%, 86.4%, 86.9%, 88.9%, 90.5%, and 87.5% accuracies.

heading: A.3 MORE EXPERIMENTS ON CIFAR-10
text: Here we show more experiments on Cifar-10.

heading: A.3.1 TARGETED TRANSFER ATTACK
text: We conduct targeted transfer attack and show the experimental results in Table 4. MTA has a great advantage over the compared methods in the targeted transfer attack setting.

heading: A.3.2 TRANSFER ATTACK WITH SMALLER
text: We set to 8 to evaluate how does MTA perform with smaller . The results shown in Table 5 indicate that MTA outperforms the compared methods no matter the value of .

heading: A.3.3 COMPARISON BETWEEN MTA AND METAATTACK
text: MetaAttack[14] is developed for query-based black-box adversarial attack but not for transfer attack. We implement MetaAttack in the transfer attack scene on Cifar-10 and compare it with MTA in Table 6. The comparison indicates that MTA greatly outperforms MetaAttack in transfer attack.

heading: A.3.4 MORE EXPERIMENTS ABOUT THE CUSTOMIZED PGD
text: As introduced in Section 3, the sign function in the vanilla PGD with L∞ constraint introduces a discrete operation. This results in that the gradient back-propagating through sign be zero and further
prohibits the training of the MSM. We propose the Customized PGD to enable the training of the MSM. Here we conduct other four experiments to validate the indispensability and the effect of the Customized PGD on the proposed MTA framework.
As PGD with L2 constraint contains no sign, in the first experiment, we use PGD with L2 constraint (PGDL2) instead of the Customized PGD to attack the MSM in the training phase and denote the trained MSM as MTAPGDL2 .
PGD with L1 constraint also contains no sign. In the second experiment, we use PGD with L1 constraint (PGDL1) to attack the MSM in the training phase and denote the trained MSM as MTAPGDL1 .
Both γ1 and γ2 of the Customized PGD are set to 0.01 by default. In the third experiment, we set γ1 to 0.05. Note that we decrease c appropriately to offset the increase of the training perturbation size caused by setting γ1 to 0.05. All the other experimental settings are consistent with the default settings. We denote the MSM trained in this experiment as MTAγ1=0.05.
In the fourth experiment, we set γ2 to 0.05 and denote the trained MSM as MTAγ2=0.05.
Table 6 reports all the four experimental results. We can get three conclusions. First, directly using PGDL1 or PGDL2 in MTA’s training stage is also effective to train the MSM but leads to limited performance. Second, the proposed Customized PGD is important for the proposed MTA framework to achieve superior performance. Third, larger γ1 or γ2 damages the performances of MTA.

heading: A.3.5 MORE EXPERIMENTS ABOUT SOURCE AND TARGET MODELS
text: Here we change the setting of source and target models, and evaluate MTA under this new setting. In this setting, the source models are MobileNet-V2, ShuffleNet-V1, ShuffleNet-V2, SqueezeNet-A, and SqueezeNet-B, and the target models are ResNet-10, ResNet-18, ResNet-34, SeResNet-14, SeResNet-26, SeResNet-50, MobileNet-V1, and MobileNet-V2. All the other experimental settings are consistent with those introduced before. The experimental results are summarized in Table 7, where MTA still shows its advantage in the transfer attack problem.

heading: A.3.6 THE EXPERIMENT WHERE SOURCE MODELS DO NOT SHARE TRAINING SAMPLES WITH TARGET MODELS.
text: In our previous experiment, the source and target models are all trained on the same training set. Here we conduct a new experiment, where we train the source and target models on different training samples, and use the new trained models to perform transfer attack. This experiment is performed on Cifar-10, which contains 10 categories and each category in the training set contains 5000 images.
In this experiment, we split the training set into two sub-training sets and each of the sub-training set contains all the 10 categories. Every category in the first sub-training set contains 2500 images and every category in the second sub-training set contains the remaining 2500 images. Therefore, there is no overlapping samples between the two sub-training sets, and the two sub-training sets share only the label set. We use the first sub-training set to train the source models and the meta-surrogate model, and use the second sub-training set to train the target models. Thus the source models and the meta-surrogate model does not use the training images of the target models. The source models are ResNet-10, ResNet-18, ResNet-34, SeResNet-14, SeResNet-26, SeResNet-50, MobileNet-V1, MobileNet-V2 with testing accuracies of 86.8%, 86.7%, 87.2%, 84.2%, 85.4%, 87.7%, 80.7%, and 80.9%, respectively. The target models are MobileNet-V3, ShuffleNet-V1, ShuffleNet-V2, SqueezeNet-A, and SqueezeNet-B with testing accuracies of 73.9%, 81.1%, 72.6%, 82.3%, and 83.0%, respectively. Then we use the source models and the trained meta-surrogate model to attack the target models. The experimental results are reported in Table 8. It is clear that when we know the label set but do not know the training images of the target models, MTA still outperforms the baselines with clear margins.

heading: A.4 THE SUPPLEMENTAL EXPERIMENTAL SETTINGS OF MTA ON IMAGENET.
text: In our experiment on ImageNet, we found that the MSM directly trained on the resolution of 224×224 often suffers from slow and unstable convergence due to the high dimensionality. Therefore, we develop a three-stage training strategy for gradually and stably training the MSM. The first training stage only trains the top 4 blocks and the classifier of the MSM. The input data xk−1adv is down-sampled by 4× and is fed into the 3rd block skipping the 1st and 2nd blocks. The perturbation gk−1ens is first up-sampled by 4× and is then added to xk−1adv to obtain xkadv . The second stage trains the top 5 blocks and the classifier. The input xk−1adv is down-sampled by 2× and is fed into the 2nd block skipping the 1st block. The third stage trains all layers. Note that, except for the newly added block in the second or third stage and the layers directly connected with the newly added block, all the other layers inherit the weights trained in the previous stage. Due to memory limitation, we set Tt to a small number of 2.
The first, second, and third training stages take 100,000, 50,000, and 50,000 iterations, with the batch size of 50, 36, and 24, respectively. Both the second and the third stages train the newly added blocks and the layers directly connected with them in the first 20,000 iterations and fine-tune all the blocks in the later 30,000 iterations. The learning rate α and the number of iterations Tt are set to 0.001 and 2, respectively. In the first, second, and third training stages, c is initialized to 3, 000, 1, 200, and 1, 200 respectively, and is exponentially decayed by 0.9× for every 4, 000, 3, 000, and 3, 000 iterations, respectively.
We refer to the data pre-processing methods in the repository7 on GitHub to pre-process the data used in our experiments on ImageNet. When the resolution of the source model is 224×224, we refer to ‘vgg preprocessing.py’ while when the resolution is 299×299, we refer to ‘inception preprocessing.py’.

heading: A.5 ATTACKING TRANSFORMER
text: We also conduct an experiment on ImageNet to evaluate how the proposed MTA performs in attacking Vision Transformer (ViT). In this experiment, the source model is Inception-V3, and the target model is Vit base patch16 2248. Experimental results are reported in Table 9. It is clear that MTA performs the best in attacking ViT.
A.6 THE NETWORK ARCHITECTURE Table 9: Transfer attack performances of MTA on ViT. Method PGD TI DI MI MTA Success Rate 5.5% 8.6% 7.0% 15.6% 21.3% DenseNet-22BC is shown in Figure 4. M1, M2, M3, and M4 are set to 80, 40, 100, and 110, respectively. We denote MTA with DenseNet-22BC backbone as MTAdense and show its performances in Table 1 of the main-body.
The simplified Inception network is a much shallower and thinner version of the official InceptionResNet-V2. Figure 5 shows the structure of the simplified Inception. The official Inception-ResNet-
7https://github.com/tensorflow/models/tree/master/research/slim/preprocessing 8https://github.com/rwightman/pytorch-image-models
BN Re LUIn
pu t
Bo tt le
 N
ec
k 
(M
2)
 *
3 Bottle Neck (M)
(a)
BN Re LU MTr an
si
tio
n 
(M
3)
M 1
BN Re
LU
Po
ol
4M Co nc at
BN
Transition 
(M)
M Po olTr an
si
tio
n 
(M
4)
Bo tt le
 N
ec
k 
(M
2 )
 *
3
Bo tt le
 N
ec
k 
(M
2 )
 *
3
Cl as
sif
ie
r
(b) (c)
V2 repeats each Indeption-resnet1-A, -B, or -C block for several times while the simplified Inception does not repeat them. We denote MTA with this backbone as MTAInc and show its performances in Table 2 of the main-body.

heading: A.7 DEFINITION OF ATTACK SUCCESS RATE.
text: The formulation of attack success rate is Rate = Card({x‖x∈Dt,M(x)=y 6=M(xadv)})Card({x‖x∈Dt,M(x)=y}) , where Dt is the test set, x is a test image and xadv is the adversarial image generated for x, y is the groundtruth label for x, M is the target model and M(x) is the prediction of the target model for x. {x‖x ∈ Dt,M(x) = y} is the set containing all clean images that are correctly classified by modelM . {x‖x ∈ Dt,M(x) = y 6=M(xadv)} is the set containing all clean images that not only are correctly classified by model M but also the corresponding adversarial images are misclassified by model M . Card({x‖x ∈ Dt,M(x) = y}) denotes the number of elements in the set {x‖x ∈ Dt,M(x) = y}.
A.8 IMPLEMENTATIONS OF THE COMPARED METHODS.
For fair comparisons between MTA and the compared methods, we tune the compared methods for their best possible performances in our re-implementation. is set to 15 by default for all methods and Tv is set to 10 for all PGD-based methods.
MI utilizes gradient momentum to make the generated adversarial examples more transferable. The most important hyper-parameter of MI is µ. In our implementation, we found that setting µ to 1 can achieve the best transfer attack performance.
DI. We follow the available public code9 of DI to implement it in Tables 1, 2, and 3. As to the experiments on ImageNet, we set ’FLAGS.image width’ and ’FLAGS.image resize’ (two parameters of the input diversity function in the official code9) to 224 and 256 respectively. On Cifar-10, we set ’FLAGS.image width’ and ’FLAGS.image resize’ to 32 and 36, respectively. For all experiments, we set p to 0.8.
TI. We directly utilize the public code10 to implement TI and TI-DI in Tables 1, and 3, respectively.
SGM uses a parameter γ to reduce the gradient from all residual modules of ResNet or DenseNet. We utilize grid search to tune γ for each ResNet and DenseNet source model shown in Table 3. We denote γ for the source model of Res-50, Res-152, DN-161, and DN-121 as γres50, γres152, γdn161, and γdn121, respectively. The tuned best γres50, γres152, and γdense for the source model group Res-50+Res-152+DN-161 are 0.20, 0.45, and 0.70, respectively. The tuned best γres50 and γdn121 for the source model group Res-50+Inc-V1+DN-121 are 0.60 and 0.85, respectively. The tuned best γres50 for the source model group Res-50+Inc-V1 is 0.65.
9https://github.com/cihangxie/DI-2-FGSM 10https://github.com/dongyp13/Translation-Invariant-Attacks
A-PGD. We directly utilize the public public code11 of A-PGD to implement it in Table 1.
AEG. By referring to the AEG’s paper and code12, we re-implement AEG on Cifar-10 and train the generator and the critic for 500 epochs with the learning rate of 0.001. The architecture of the generator is the encoder-decoder defined in Tab.7 of AEG’s paper. We do not implement AEG on ImageNet because training the generator and critic is expensive on ImageNet.
IR. We directly utilize the public code13 of IR to implement it on ImageNet. When implementing IR on Cifar-10, we set the hyper-parameter ‘args.grid scale’ to 1.

heading: A.9 TRAINING CURVES
text: In the training process of the MSM, we evaluate MTA’s transfer attack performances on the target models for every 250 iterations. Figure 6 visualizes the performance curves on eight Cifar-10 target models. It is observed that with the training going on, the transfer attack success rates on the target models rise gradually. The periodic fluctuations of the performances are caused by the periodic decay of the hyper-parameter c described in Section 4.1.1.

heading: A.10 COMPUTATIONAL COST
text: We conduct all experiments on Tesla P40 GPU. The computational cost can be summarized into training cost and inference cost happened in the training and the inference phases, respectively. The training cost of the proposed MTA depends mainly on the backbone of MSM, the used source models, the dataset, the batch size, Tt, and etc.. On Cifar-10, the default backbone of the MSM is ResNet-13, the batch size is 64, Tt = 7, and we use 8 source models to train the MSM. The training costs one P40 GPU and approximately 2.5T FLOPs per iteration. On ImageNet, the default backbone of the MSM is ResNet-19, Tt = 2, the batch size is 24 in the third training stage. When using the Inc-V3 source model to train the MSM, the third training stage costs one P40 and approximately 3.2T FLOPs per iteration. When using the Res-152, Res-50, and DN-161 source models to train the MSM, the third training stage costs three P40 GPUs and approximately 6.5T FLOPs per iteration.
In the inference phase (generating adversarial examples and attack the target models), the cost of MTA depends mainly on the backbone of MSM and Tv. The inference cost of baselines depend on the source models and Tv. On ImageNet, when using the Res-152, Res-50, and DN-161 source models, the PGD-based baselines (DI, MI, TI, SGM) cost about 124.1 GFLOPs per gradient ascent step per image, and cost about 109.1M parameters. As a comparison, the inference cost of MTA is only 11.3 GFLOPs per gradient ascent step per image and the parameter the MTA needed is only 6.77M. Obviously, both the inference cost and the parameter the MTA used is much smaller than those of the PGD-based baselines, and this is another advantage of the proposed MTA over the PGD-based baselines.
A.11 VISUALIZATION OF ADVERSARIAL EXAMPLES
Figure 7 visualizes the adversarial examples and the noises generated for the corresponding clean images via MI, DI, TI, SGM, IR, and MTA. All the clean images are sampled from the testing set of ImageNet.

heading: A.12 THE TENSORFLOW CODE
text: We show the simplified core code of MTA on the last two pages for a better understanding of our work. Note that the showed code is used for the experiments on Cifar-10 but not on ImageNet. The code used on ImageNet differs slightly from the showed code.
11https://github.com/fra31/auto-attack 12https://github.com/joeybose/Adversarial-Example-Games 13https://github.com/xherdan76/A-Unified-Approach-to-Interpreting-and-Boosting-Adversarial-
Transferability
1 import tensorflow as tf 2 3 class Meta_Transfer_Attack: 4 def __init__(self): 5 # Define some hyperparameters 6 self.lr = tf.placeholder_with_default(0.001, ()) 7 self.epsilon_c = tf.placeholder_with_default(1, ()) 8 # Define the meta-surrogate model 9 self.MSM = ResNet13()
10 # Define the source models 11 self.source_models = [ResNet(10), ..., MobileNet_V2()] 12 # Define the input data and the label 13 self.image = tf.placeholder(tf.float32, shape=[None, 32, 32, 3]) 14 self.label = tf.placeholder(tf.float32, shape=[None, 10]) 15 16 def build_training_graph(self, T): 17 # The initial adversarial examples are the clean images 18 attack = self.image 19 with tf.variable_scope('surrogate', reuse=tf.AUTO_REUSE): 20 for k in range(T): 21 # Predict the adversarial examples 22 surrogate_logits = self.MSM.predict(attack) 23 24 # meta-surrogate models' loss on the adversarial examples. 25 surrogate_loss = Cross_entropy(logits=surrogate_logits, 26 labels=self.label) 27 28 # calculate Gˆk 29 grad = tf.gradients(surrogate_loss, attack)[0] 30 31 # calculate Gˆk_1 32 grad_1 = grad / tf.reduce_sum(tf.abs(grad), axis=[1,2,3], 33 keep_dims=True) 34 35 # calculate Gˆk_t 36 mean_abs_grad = tf.reduce_mean(tf.abs(grad), axis=[1,2,3], 37 keep_dims=True) 38 norm_one_grad = grad / mean_abs_grad 39 grad_atan = tf.atan(norm_one_grad) * (2 / 3.1415926) 40 41 # calculate Gˆk_s 42 grad_sign = tf.sign(grad) 43 44 # calculate Gˆk_ens 45 grad_ens = grad_1 + 0.01 * grad_sign + 0.01 * grad_atan 46 47 # Obtain the adversarial examples Xˆk_adv 48 attack_temp = attack + (self.epsilon_c / T) * grad_ens 49 attack = tf.clip_by_value(attack, 0.0, 1.0) 50 51 # Evaluate the adversarial examples XˆT_adv on the source models 52 with tf.variable_scope('Source', reuse=tf.AUTO_REUSE): 53 for model in self.source_models: 54 logits = model.predict(attack) 55 loss = Cross_entropy(logits=logits, labels=self.label) 56 self.source_loss += tf.reduce_mean(loss)/len(self.source_models) 57
58 59 def build_optimizing_graph(self): 60 opt = tf.train.AdamOptimizer(self.lr) 61 # Optimize the MSM via maximizing the source models' loss. 62 gvs = opt.compute_gradients(-self.source_loss, self.MSM.weight) 63 gvs = [(tf.clip_by_value(grad, -15, 15), var) for grad, var in gvs] 64 self.train_op = optimizer.apply_gradients(gvs) 65
66 def main(): 67 # Initialize the settings. 68 Batch_size = 64 69 Init_eps_c = 1600 / 255 70 71 # Define the graph 72 MTA = Meta_Transfer_Attack() 73 MTA.build_training_graph(7) 74 MTA.build_optimizing_graph() 75 76 # Define the data loader 77 Cifar10_dataloader = DataSet('Cifar10') 78 79 sess = tf.InteractiveSession() 80 tf.global_variables_initializer().run() 81 82 # Restore the weights of all source models 83 restore_source_weights(MTA.source_models, sess) 84 85 for iter in range(47000): 86 # Exponentially decay eps_c by 0.9× for every 4000 iterations. 87 eps_c = Init_eps_c * ( 0.9 ** int(iter / 4000) ) 88 89 images, labels = Cifar10_dataloader.get_data(Batch_size) 90 91 feed_dict = {} 92 feed_dict[MTA.image] = images 93 feed_dict[MTA.label] = labels 94 feed_dict[MTA.lr] = 0.001 95 feed_dict[MTA.epsilon_c] = eps_c 96 97 # Train the MSM 98 sess.run(MTA.train_op, feed_dict)

Review summaries:
A complete black box adversarial attack thus far has not performed well as research shows. By complete black box, it means there is no information available about the target model, not even query based probing. Most SOTA uses a surrogate model to generate adversarial examples, where the surrogate model may, every likely, not in any way resemble the target model in practice. This paper claims that by adopting a meta training scheme, more effective black box attacks are achievable when compared to the SOTA.

In this paper, the authors proposed a novel method of Meta-Surrogate Model (MSM) which can generate more transferable adversarial examples in the black-box adversarial attacks. The problem is formulated as a bi-level-like optimization problem which achieved via a differentiable attacker. Extensive experiments demonstrate its effectiveness in generating the transferable adversarial examples.