Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attacks
Authors: Jiadong Lin
Chuanbiao Song
Kun He
Liwei Wang
John E. Hopcroft
Venue:  (2020)
Keywords: adversarial examples
adversarial attack
transferability
Nesterov accelerated gradient
scale invariance

Abstract: Deep learning models are vulnerable to adversarial examples crafted by applying human-imperceptible perturbations on benign inputs. However, under the black-box setting, most existing adversaries often have a poor transferability to attack other defense models. In this work, from the perspective of regarding the adversarial example generation as an optimization process, we propose two new methods to improve the transferability of adversarial examples, namely Nesterov Iterative Fast Gradient Sign Method (NI-FGSM) and Scale-Invariant attack Method (SIM). NI-FGSM aims to adapt Nesterov accelerated gradient into the iterative attacks so as to effectively look ahead and improve the transferability of adversarial examples. While SIM is based on our discovery on the scale-invariant property of deep learning models, for which we leverage to optimize the adversarial perturbations over the scale copies of the input images so as to avoid "overfitting” on the white-box model being attacked and generate more transferable adversarial examples. NI-FGSM and SIM can be naturally integrated to build a robust gradient-based attack to generate more transferable adversarial examples against the defense models. Empirical results on ImageNet dataset demonstrate that our attack methods exhibit higher transferability and achieve higher attack success rates than state-of-the-art gradient-based attacks.

Published as a conference paper at ICLR 2020
NESTEROV ACCELERATED GRADIENT AND SCALE INVARIANCE FOR ADVERSARIAL ATTACKS
Jiadong Lin & Chuanbiao Song & Kun He School Computer Science and Technology
Liwei Wang
School of Electronics Engineering and Computer Sciences, Peking University Peking, China
Huazhong University of Science and Technology Wuhan, 430074, China
{idlin, obsong, www.k @hust edu. en
wanglw@cis pku. edu, cn
John E. Hoperoft
Department of Computer Science Cornell University, NY 14853, USA jeh0cs. cornell.edt
ABSTRACT
Deep learning models are vulnerable adversarial examples crafted by applying numan-imperceppible perturbations on benign inputs. However, under the black- box setting, most existing adversaries often have a poor transferability to attack other defense models. In this work, from the perspective of regarding the adversar- ial example generation as an optimization process, we propose two new methods to improve the transfcrability of adversarial examples, namely Nesterov Iterative attack Method (SIM).
Fast Gradient Sign Method (NI-FGSM) and NI-FGSM aims to adapt Nesterov accelerated gradient into the iterative attacks so as to effectively look ahead and improve the transferability of adversarial ex- amples. While SIM is based on discovery the scale-invariant property of deep learning models, for which we leverage to optimize the adversarial per- turbations over the scale copies of the input images so on the white-box model being attacked and generate more transferable adversar- ial examples. NI-FGSM and SIM can be naturally integrated to build a robust gradient- based attack to generate more transferable adversarial examples against the defense models. Empirical results on ImageNet dataset demonstrate that our attack methods exhibit higher transferability and achieve higher attack success rates than state-of the-art gradient- based attacks.
avoid "overfitting"
INTRODUCTION
Deep learning models have been shown to be vulnerable to adversarial examples (Goodfellow et al., 2014 Szegedy et al. 2014), which are generated by applying imnereeippereettbblee perturbations on benign input to result in the misclassification. In addition, adversarial examples have an intriguing property of transferability, where adversarial examples crafted by the current model can also fool other unknown models. As adversarial examples can help identify the robustness of models (Arnab) ct al. 2018). as well as improve the robustness of models by adversarial training (Goodfellow et al. 2014 learning how generate adversarial examples with high transferability is important and has gained increasing attentions in the literature (Liu et al. 2016 Dong et al.) 2018 Xie et al.) 2019
Dong al. 2019 Wang et al. 2019).
Several gradient-based attacks have been proposed to generate adversarial examples, such as one- step attacks (Goodfellow al. 2014) and iterative attacks (Kurakin al.) (0166] Dong al. 2018). Under the white-box setting, with the knowledge of the current model, existing attacks can achieve high success rates. However, they often exhibit low success rates under the black-box setting, es-
pecially for models with defense mechanism, such as adversarial training (Madry et al. 20118 Song
"Corresponding author.

---

Published as a conference paper at ICLR 2020
al. 2019) and input modification (Liao et al. 2018 Xie et al. 2018). Under the black-box setting, most existing attacks fail to generate robust adversanal examples against defense models.
In this work, by regarding the adversarial example generation process optimization process, propose two new methods to improve the transferability adversarial examples: Nesterov Iterative Fast Gradient Sign Method (NI-FGSM) and Scale-Invariant attack Method (SIM).
Inspired by the fact that Nesterov accelerated gradient (Nesterov) 1983) is superior to momentum for conventionally optimization (Sutskever et al., 2013), we adapt Nesterov accelerated gradient into the iterative gradient-base based attack, so as to effectively look ahead and improve the transfer- ability of adversarial examples. We expect that NI-FGSM could replace the momentum iterative gradient-based method (Dong al. 2018) in the gradient accumulating portion and yield higher performance.
Besides, we discover that deep learning models have the Scale-Invariant attack Method (SIM) to improve the transferability of adversarial examples by optimizing the adversarial perturbations over the scale copies of the input images. SIM can avoid "overfitting" on the white-box model being attacked and generate more transferable adversarial examples against other black-box models.
property, and propose
We found that combining our NI-FGSM and SIM with existing gradient-based attack methods (e.g., diverse input method (Xie et al. 2019)) can further boost the attack success rates of adver- sarial examples.
Extensive experiments the ImageNet dataset [Russakovsky al. 2015) show that methods attack both normally trained models and adversarially trained models with higher attack success rates than existing baseline attacks. Our best attack method, SI-NI-TI-DIM (Scale-Invariant Nes- terov Iterative FGSM integrated with translation-invarice success rate of 93.5% against adversarially trained models under the black-box setting, For further demonstration, we evaluate our methods by attacking the latest robust defense methods (Liao et al., 2018 Xie al. 2018 Liu al., 2019 Tia et al. 2019 Cohen et al. 2019). The results show that our attack methods can generate adversarial examples with higher transferability than state-of-the- art gradient-bar based attacks.
diverse input method), reaches an average
PRELIMINARY
NOTATION
Let and y true be benign image and the corresponding true label, respectively. Let J(x, true) be the loss function of the classifier (e.g. the cross-entropy loss). Let ae be the adversarial example of the benign image x. The goal of the non-targeted adversaries
search adversarial example x ad to maximize the loss ao y trree) in the Ep norm bounded perturbations. To align with previous works, we focus on p oo in this work to measure the distortion between ade and r. That is
I ad x ll where is the magnitude of adversarial perturbations.
2.2 ATTACK METHODS
Several attack methods have been proposed to generate adversarial examples. Here provide brief introduction.
Fast Gradient Sign Method (FGSM). FGSM (Goodfellow al. 2014) generates adversarial example ady by maximizing the loss function [2 y (ue)) with one-step update as:
adv x + sign V y ( frue))
(1)
where sign(.) function restricts the perturbation in the Loc norm bound.
Iterative Fast Gradient Sign Method (I-FGSM), Kurakin Kurakin et al. (016) extend FGSM to an iterative
version by applying FGSM with small step size a:
Zo x,
adv 2
Clip (2n de + a sign( V (2 (aade )r
(2)
where (.ip function restricts generated adversarial examples to be within the e-ball of a..
2

---

Published as a conference paper at ICLR 2020
Projected Gradient Descent (PGD). PGD attack (Madry et al. 2018) is strong iterative variant of FGSM. It consists of a random start within the allowed norm ball and then follows by running several iterations of I-FGSM to generate adversarial examples.
Momentum Iterative Fast Gradient Sign Method (MI-FGSM), Dong et al. (2018) integrate mo- mentum into the iterative attack and lead to higher transferability for adversarial examples. Their update procedure formalized as follows:
Vz. (zgdo by
9++1 = 1. +
V 2 (agioo ytuue) Ill
(3)
adv x 2+1
Clips (= + a (igsing(g++)))
where 9t is the accumulated gradient at iteration f, and μ is the decay factor of gr-
Diverse Input Method (DIM). Xie et al. (2019) optimize the adversarial perturbations over the diverse transformation of the input image each iteration. The transformations include the random resizing and the random padding. DIM can be naturally integrated into other gradient-base attacks further improve the transferability of adversarial examples.
Translation-Invarian Method (TIM). Instead of optimizing the adversarial perturbations on a sin- gle image, Dong al. (2019) use a of translated images optimize the adversarial perturbations. They further develop an efficient algorithm to calculate the gradients by convolving the gradient at untranslated images with a kernel matrix. TIM can also be naturally integrated with other gradient- based attack methods. The combination of TIM and DIM, namely TI-DIM, is the current strongest black-box attack method.
Carlini & Wagner attack (C&W). C&W attack (Carlini & Wagner 2017 is an aptimization-basee method which directly optimizes the distance between the benign examples and the adversarial examples by solving:
arg min |laado =11, - J( , (rrue).
is a powerful method to find adversarial examples while minimizing perturbations for white-box attacks, but it lacks the transferability for black-box attacks.
2.3 DEFENSE METHODS
Various defense methods have been proposed to against adversarial examples, which can fall into the following two categories.
Adversarial Training. One popular and promising defense method is adversarial training (Good- fellow et al. 2014 Szzgedy et al.] 2014; Zhai et al. 2019; Song et al. 2020), which augments the training data by the adversarial examples in the training process. Madry et al. (2018) develop cessful adversarial training method, which leverages the projected gradient descent (PGD) attack to generate adversarial examples. However, this method is difficult scale to large-scale datasets (Ku- rakin et al.) 2017). Tramm et al. (2018) propose ensemble adversarial training by augmenting the training data with perturbations transferred from various models, as to further improve the robust- ness against the black-box attacks. Currently, adversarial training is still one of the best techniques defend against adversarial attacks.
Input Modification. The second category of defense methods aims to mitigate the effects of ad- versarial perturbations by modifying the input data. Guo al. (2018) discover that there exists a range of image transformations, which have the potential to remove adversarial perturbations while preserving the visual information of the images. Xie et al, (2018) mitigate the adversarial effects through random transformations. [Liao et al. (2018) propose high-level representation guided de- noiser to purify the adversarial examples. [iu al. (2019) propose a JPEG-based defensive com- pression framework to rectify adversarial examples without impacting classification accuracy on benign data. Jia et al. (2019) leverage an end-to-end image compression model to defend adversar- ial examples. Although these defense methods perform well in practice, they not tell whether the model is truly robust to adversarial perturbations, [ohhen et (2019 use randomized smoothing to obtain an ImageNet classifier with certified adversarial robustness.
3

---

Published as a conference paper at ICLR 2020
3 METHODOLOGY
3.1 MOTIVATION
Similar with the process of training neural networks, the process of generating adversarial examples can also be viewed as an optimization problem. In the optimizing phase, the white-box model being attacked optimize the adversarial examples can be viewed the training data the training process. And the adversarial examples can be viewed as the training parameters of the model. Then in the testing phase, the black-box models evaluate the adversarial examples can be viewed the testing data of the model.
From the perspective of the optimization, the transferability of the adversarial examples is similar with the generalization ability of the trained models (Dong et al. 2018). Thus, we can migrate the methods used to improve the generalization of models to the generation of adversarial examples, so as to improving the transferability of adversarial examples.
Many methods have been proposed to improve the generalization ability of the deep learning mod- els, which can be split to two aspects: (1) better optimization algorithm, such as Adam opti- mizer(Kingga Ba, 2014]; (2) data augmentation (Simonyan & Zisserman, 2014). Correspond- ingly, the methods to improve the transferability of adversarial examples can also be split to two aspects: (1) better optimization algorithm, such as MI-FGSM, which applies the idea of momen- tum; (2) model augmentation (i.c., ensemble attack on multiple models), such as the work of Dong itt al. (2018), which considers to attack multiple models simultancously. Based on above analysis, aim to improve the transferability of adversarial examples by applying the idea of Nesterov celerated gradient for optimization and using set of scaled images to achieve model augmentation.
3.2 NESTEROV ITERATIVE FAST GRADIENT SIGN METHOD
Nesterov Accelerated Gradient (NAG) Nesterov 1983) is slight variation of normal gradient descent, which can speed up the training process and improve the convergence significantly. NAG can be viewed as improved momentum method, which be expressed as:
Vt++1 = 14 Ut + Vo, J(0, a 1 pe)),,
(5)
O.+1 O. U2+1-
Typical gradient-based iterative attacks (e.g., I-FGSM) greedily perturb the images in the direction of the sign of the gradient at each iteration, which usually falls into poor local maxima, and shows weak transferability than single-step attacks (e.g., FGSM). Dong al. (2018) show that adopting momentum (Polyak 1964) into attacks can stabilize the update directions. which helps to escape from poor local maxima and improve the transferability. Compared to momentum, beyond stabilize the update directions, the anticipatory update of NAG gives previous accumulated gradient a correc- tion that helps to effectively look ahead. Such looking ahead property of NAG can help us escape from poor local maxima easier and faster, resulting in the improvement transfcrability.
We integrate NAG into the iterative gradient-based attack to leverage the looking ahead property of NAG and build a robust adversarial attack, which refer to NI-FGSM (Nesterov Iterative Fast Gradient Sign Method). Specifically, we make a jump in the direction of previous accumulated gradients before computing the gradients in each iteration. Start with 9n 0, the update procedure of NI-FGSM can be formalized as follows:
znEE Itt adv P 11-1t
V JIJ Frue V Jx (ruee)
9++1 Dt +
adv 2t+1
Clip (2fdr + a sign(g(+1)
(8)
where denotes the accumulated gradients at the iteration f, and ju denotes the decay factor of gt-
3.3 SCALE-INVARIANT ATTACK METHOD
Besides considering better optimization algorithm for the adversaries, can also improve the transferability of adversarial examples by model augmentation. We first introduce a formal definition of loes-pregg transformation and model augmentation as follows.
4

---

Published as a conference paper at ICLR 2020
Definition 1 Lossppreserving Transformation. Given input with its ground-truth label ytuu and a classifier f(z) x E 2 - E y with the cross-entropy loss [z, y), if there exists an impur transformation T-) that satisfies (T(x)), (rue) z ((I,y"re)) for any E X, say T()) is
loss-preserving transformation.
Definition Model Augmentation. Given an input x with its ground-truth label gr and a model f(z) X y E Y with the cross-entropy loss J(z, y). if there exists los--preserving transformation T.),, then we derive a new model by f'(x) = f(T())) from the original model f. define such derivation of models model augmentation.
Intuitively, similar to the generalization of models that can be improved by feeding more training data, the transferability of adversarial examples can be improved by attacking more models simulta- neously. Dong al. (2018) enhance the gradient-basee attack by attacking ensemble of models. However, their approach requires training a set of different models to attack, which has a large com- putational cost. Instead, in this work, derive ensemble of models from the original model by model augmentation, which is a simple way of obtaining multiple models via the loss-preserving transformation.
To get the loss-presg transformation, we discover that deep neural networks might have the scale-invariant property, besides the translation invariance. Specifically, the loss values are similar for the original and the scaled images on the same model, which is empirically validated in Section 4.2 Thus, the scale transformation can be served as a model augmentation method. Driven by the above analysis, we propose a Scale-Invariane attack Method (SIM), which optimizes the adversarial perturbations over the scale copies of the input image:
Σ (S,(2a)))) grrue),
arg max gadv
17L
(9)
1=0
s.t. 1lo
- 2 2011o Se
where S,(x) x/2' denotes the scale copy of the input image with the scale factor 1/2", and m denotes the number of the scale copies. With SIM, instead of training set of models to attack, effectively achieve ensemble attacks on multiple models by model augmentation. More importantly. it can help avoid "overfitting" on the white-box model being attacked and generate more transferable adversarial examples.
3.4
ATTACK AL.GRRITHM
For the gradient processing of crafting adversarial examples, NI-FGSM introduces a better optimiza- tion algorithm stabilize and correct the update directions at each iteration. For the ensemble attack of crafting adversarial examples, SIM introduces model augmentation to derive multiple models to attack from a single model. Thus, NI-FGSM and SIM can be naturally combined to build stronger attack, which we refer to SI-NI-FGSM (Scale- Invarianv Nesterov Iterative Fast Gradient Sign Method). The algorithm of SI-NI-FGSM attack summarized in Algorithm 1
In addition, SI-NI-FGSM can be integrated with DIM (Diverse Input Method), TIM (Translation- Invariant Method) and TI-DIM Arranslation-Invaiian with Diverse Input Method) as SI-NI-DIM, SI- NI-TIM and SI-NI-TI-DIM, respectively, to further boost the transferability of adversarial examples. The detailed algorithms for these attack methods are provided in Appendix
EXPERIMENTAL RESULTS
In this section, we provide experimental evidence on the advantage of the proposed methods. We first provide experimental setup. followed by the exploration of the scale-invariance property for deep learning models. We then compare the results the proposed methods with baseline methods in Section 4.3 and 4.4 on both normally trained models and adversarially trained models. Beyond the defense models based on adversarial training, we also quantify the effectiveness of the proposed methods other advanced defense in Section 4.5] Additional discussions, the comparison between NI-FGSM and MI-FGSM and the comparison with classic attacks, are in Section 4.6 Code is
available at https: htt.t/ttt...tooo//o con/ /OTT//STNTTT. PGSK
5

---

Published as a conference paper at ICLR 2020
Algorithm SI-NI-FGSM
Input: A clean example with ground- truth label y'rue; classifier f with loss function J;
Input: Perturbation size e; maximum iterations l'; number of scale copies m and decay factor μ..
Output: An adversarial example zadv
a c/T
2: 90 = 0;
3: for t T
do
4: 9
5: Get x7 by Eq.
make a jump in the direction of previous accumulated gradients
6:
for i 0
do
sum the gradients over the scale copies of the input image
7:
Get the gradients by V [( ). frue)
8:
Sum the gradients as g - g + V (
(St())))) truee)
9:
Get average gradients as = 1 9
10:
Update 9++11 by 9++1 μ 9t Tall
11:
Update 29 by Eq. (8)
12:
return add Iddo
4.1 EXPERIMENTAL SETUP
Dataset. We randomly choose 1000 images belonging to the 1000 categories from ILSVRC 2012 validation set, which are almost correctly classified by all the testing models.
Models. For normally trained models, we consider Inception-v3 (Inc-v3) (Szegedy et al. 2016). Inception-v4 (Inc-v4), Inception-Restee Resnet--2 (IncRes-v2) (Szegedy et al. 2017) and R2s1et-v2-101 (Res-101) (He et al. 2016). For adversarially trained models, we consider InC-v3ens3. Inc-v3ense and IncRes-v2u... (Tramr al. 2018).
Additionally. we include other advanced defense models: high-level representation guided denoiser (HGD) (Liao et al. 2018), random resizing and padding (R&P) (Xie et al. 2018 NIPS-rã" feature distillation (FD) ( Liu et al. 2019), purifying perturbations via image compression model (Comde- fend) (Tia al. 2019) and randomized smoothing (RS) (Cohen et al. 2019).
Baselines. We integrate our methods with DIM (Xie et al., 2019). TIM, and TI-DIM (Dong et al,, 2019), to show the performance improvement of SI-NI-FGSM over these baselines. Denote our SI-NI-FGSM integrated with other attacks as SI-NI-DIM, SI-NI-TIM, and SI-NI-TIM-DIM, respec- tively.
Hyper-parameters. For the hyper-parameters, we follow the settings in (Dong et al., 2018) with the maximum perturbation as e 16, number iteration T 10, and step size 1.6. For MI-FGSM, we adopt the default decay factor μ 1.0. For DIM, the transformation probability is set to 0.5. For TIM, we adopt the Gaussian kernel and the size of the kernel is set SI-NI-FGSM, the number of scale copies is set to m = 5.
For our
4.2 SCALE- PROPERTY
To validate the scale-invaree invariant property of deep neural networks, we randomly choose 1,000 original images from ImageNet dataset and keep the scale size in the range [0.1, 2.0] with a step size 0.1. Then we feed the scaled images into the testing models, including Inc-v3, Inc-v4, IncRes-2, and Res-101, to get the average loss over 1,000 images.
As shown in Figure [ scale size is in range 1, 1.3). That is, the loss values are very similar for the original and scaled images. So assume that the scale-invariant property of deep models is held within [0.1, 1.3). and we leverage the scale-invariant property to optimize the adversarial perturbations over the scale copies of the input images.
easily observe that the loss curves smooth and stable when the
hetes: https:://iituub..om/// h

---

Published as a conference paper at ICLR 2020
Inc-v3
Average Loss Value
Inc-v4
0.6
IncRes-v2
Res-101
0.4
0.2
0.5
1.5
2
Scale Size
Figure 1: The average losses for Inc-v3, Inc-v4, IncRes-v2 and Res-101 each scale size. The results are averaged over 1000 images.
4.3 ATTACKING A SINGLE MODEL
In this subsection, we integrate our SI-NI-FGSM with TIM, DIM and TI-DIM, respectively. and compare the black-box attack success rates of extensions with the baselines under single model setting. As shown in Table I our extension methods consistently outperform the baseline attacks by 10% 35% under the black-box setting, and achieve nearly 100% success rates under the white-box setting. It indicates that SI-NI-FGSM can serve powerful approach to improve the transferability of adversarial examples.
4.4 ATTACKING AN ENSEMBLE OF MODELS
Following the work of (Liu et al. 2016), we consider show the performance of our methods by attacking multiple models simultaneously. Specifically, we attack an ensemble of normally trained models (including Inc-v3, Inc-v4, IncRes-v2 and Ros- with equal ensemble weights using TIM, SI-NI-TIM, DIM, SI-NI-DIM, TI-DIM and SI-NI-TI-DIM, respectively.
As shown Table 2 our methods improve the attack success rates across all experiments over the baselines. In general, under the black-box box setting. Especially, SI-NI-TI-DIM, the extension by combining SI-NI-FGSM with TI-DIM, can fool the adversarially trained models with high average success rate of 93.5%. It indicates that these advanced adversarially trained models provide little robustness guarantee under the black-box attack of SI-NI-TI-DIM.
methods consistently outperform the baseline attacks by 10% 30%
4.5 ATTACKING OTHER ADVANCED DEFENSE MODELS
Besides normally trained models and adversarially trained models, we consider to quantify the ef- fectiveness of our methods on other advanced defenses, including the top-3 defense solutions in the NIPS competition (high-level representation guided denoiser (HGD, rank-1) (Liao al. 2018), ran- dom resizing and padding (R&P, rank-2) (Xie et al. 2018) and the rank-3 submission (NIPS-r3), and three recently proposed defense methods (feature distillation (FD) (Liu et al.) 2019), purifying per- turbations via image compression model (Comdefend) (Jia et al. 2019) and randomized smoothing (RS) (Cohen et al. 2019h) ).
We compare SI-NI-TI-DIM with MI-FGSM (Dong al. 2018). which is the top-1 attack solu- tion the NIPS 2017 competition, and TI-DIM (Dong et al. 2019), which is state-of-the-an attack. We first generate adversarial examples the ensemble models, including Inc-v3, Inc-v4, IncRes- v2, and Res- 101 by using MI-FGSM, TI-DIM, and SI-NI-TI-DIM, respectively. Then, we evaluate the adversarial examples attacking these defenses.
As shown in Table 3, our method SI-NI-TI-DIM achieves an average attack success rate of 90.3%, surpassing state-of-the-an attacks by large margin of 14.7%. By solely depending the trans-

---

Published as a conference paper at ICLR 2020
Table I: Attack success rates (%) of adversarial attacks against seven models under single- model setting. The adversarial examples are crafted on Inc-v3, Inc-v4, IncRes-v2, and Res-101 respectively. indicates the white-box attacks.
(a) Comparison of TIM and the SI-NI-TIM extension.
Model
Attack
Inc-v3
Inc-v4
IncRes-v2
Res-101
Inc-V3.ma
Inc-VSend
IncRes-V2.n.
TIM
100.0*
47.8
42.8
39.5
24.0
21.4
12.9
Inc-v3
SI-NI-TIM (Ours)
100.0*
77.2
75.8
66.5
33,5
TMM
58.5
99.6*
47.5
43.2
25.7
23.3
17.3
Inc-v4
SI-NI-TIM (Ours)
83.5
100.0*
76.6
68.9
57.8
54.3
42.9
TIM
62.0
56.2
97.5*
51.3
32.8
27.9
21.9
IncRes-v2
SI-NI-TIM (Ours)
86.4
83.2
99.5*
77.2
66.1
60.2
57.1
TIM
59.0
53.6
51.8
99.3*
36.8
32.2
23.5
Res-101
SI-NI-TIM (Ours)
78.3
74.1
73.0
99.8
58.9
53.9
43.1
(b) Comparison of DIM and the SI-NI-DIM extension.
Model
Attack
Inc-v3 Inc-v4
IncRes-v2
Res-101
Inc-v3
Inc-v3
IncRes-
DIM
98.7*
67.7
62.9
9.7
Inc-v3
SI-NI-DIM (Ours)
99.6*
84.7
81.7
75.4
36.9
34.6
20.2
DIM
70.7
98.0*
63.2
55.9
21.9
22.3
11.9
Inc-v4
SI-NI-DIM (Ours)
89.7
99.3*
84.5
78.5
47.6
45.0
28.9
DIM
69.1
63.9
93.6*
57.4
29.4
24.0
17.3
IncRes-v2
SI-NI-DIM (Ours)
89.7
86.4
99.1
81.2
55.0
48.2
38.1
Res-101
DIM
75.9
70.0
71.0
98.3*
36.0
32.4
19.3
SI-NI-DIM (Ours)
88.7
84,2
84.4
99,3*
52.4
48.0
33,2
(c) Comparison of TI-DIM and the SI-NI-TI-DIM extension.
Model
Attack
Inc-v3 Inc-v4
IncRes-v2
Res- 101
Inc-v3
Inc-v3mmtt
IncRes-v2
TI-DIM
98.3*
63.0
56.1
38.6
34.9
22.5
Inc-v3
SI-NI-TI-DIM (Ours)
99.6*
85.5
80.9
75.7
61.5
56.9
40.7
TEDIM
72.5
97.8*
63.4
54.5
38.1
35.2
25.3
Inc-v4
SI-NI-TI-DIM (Ours)
88.1
99.3*
83.7
77.0
65.0
63.1
49.4
T1-DIM
73.2
67.5
92.4*
61.3
46.4
40.2
35.8
IncRes-v2
SI-NI-TI-DIM (Ours)
89.6
87.0
99.1*
83.9
74.0
67.9
63.7
T1-DIM
74.9
37.8
Res-101
SI-NI-TI-DIM (Ours)
86.4
82.6
84,6
99.0*
72.6
66.8
56.4
Table 2: Attack success rates (%) of adversarial attacks against seven models under multi- model setting. * indicates the white-box models being attacked.
Attack
Inc-v3*
Inc-v4
IncRes-v2*
Res- -0s-
Inc-v3eusa
Inc-V3easd
IncRes-v2
TIM
99.9
99.3
99.3
99.8
71.6
67.0
53.2
SI-NI-TIM (Ours)
100.0
100.0
100.0
100.0
93.2
90.1
84.5
DIM
99.7
99.2
98.9
98.9
66.4
60.9
41.6
SI-NI-DIM (Ours)
100.0
100.0
100.0
99.9
88.2
85.1
69.7
TI-DIM
99.6
98.8
98.8
98.9
85,2
80.2
73.3
SI-NI-TI- TI-DIM (Ours)
99.9
99.9
99.9
99,9
96,0
94.3
90.3
ferability of adversarial examples and attacking on the normally trained models, SI-NI-TI-DIM can fool the adversarially trained models and other advanced defense mechanism, raising new secu- rity issue for the development more robust deep learning models. Some adversarial examples generated by SI-NI-TI-DIM are shown in Appendix B
Table 3: Attack suceess rates (%) of adversarial attacks against the advanced defense methods.
Attack
HGD
R&P
NIPS-13
FD
ComDefend
RS
Average
MI-FGSM
36.9
29.3
40.8
51.6
47.5
27.1
38,9
TI-DIM
84.8
75.3
80.7
83.5
79.1
50.3
75.6
SI-NI-TI-DIM (Ours)
96.1
91.3
94.4
95,4
93.3
71.4
90.3
8

---

Published as a conference paper at ICLR 2020
4.6 FURTHER ANALYSIS
NI-FGSM vs. MI-FGSM. We perform additional analysis for the difference between NI-FGSM with MI-FGSM (Dong al. 2018). The adversarial examples are crafted on Inc-v3 with various number of iterations ranging from 4 to 16, and then transfer to attack Inc-v4 and IncRes-v2. As shown in Figure NI-FGSM yields higher attack success rates than MI-FGIMM with the same num- ber of iterations. In another view, NI-FGSM needs fewer number of iterations gain the same attack success rate MI-FGSM. The results not only indicate that NI-FGSM has a better transfer- ability, but also demonstrate that with the property of looking ahead, NI-FGSM can accelerate the generation of adversarial examples.
20.5
Allnck Suucess Rate (%)
Attack Saccess
Autaa Almoa Successe
893
MM.-GGM
NI-FOSM
XI-FGSM
14
6
11
6. 13
14
Iteration Number
Eteration Number
Dteaaion Number
(a) Inc-v3 model
(b) Inc-v4 model
(c) IncRes-v2 model
Figure 2: Attack success rates (%) NI-FGSM and MI-FGSM on various number itera- tions. The adversarial examples are crafted on Inc-v3 model against (a) Inc-v3 model, (b) Inc-v4 model and (c) IncRes-v2 model.
Comparison with classic attacks. We consider to make addition comparison with classic attacks, including FGSM (Goodfellow al. (014), I-FGSM (Kurakin al.] (016)) PGD (Madry et al. 2018) and C& W (Carlini & Wagner 2017). As shown in Table[4 our methods achieve 100% attack success which is the same C&W under the white-box setting, and significantly outperform other methods under the black-box setting.
Table 4: Attack success rates (%) of adversarial attacks against the models. The adversarial examples are crafted on Inc-v3 using FGSM, I-FGSM, PGD, C&W, NI-FGSM, and SI-NI-FGSM. indicates the white-box model being attacked.
Attack
Inc-v3
Inc-v4
IncRes-v2
Res- 101
Inc-v3aus
Inc-v3unst
IncRes-v2... V
Average
FGSM
67.1
26.7
25.0
24.4
10.5
10.0
4.5
24.0
I-FGSM
99.9
20.7
18.5
15.3
3.6
5.8
2.9
23.8
PGD C&W
99.5
17.3
15.1
13.1
6.1
5.6
3.1
20.9
100.0
18.4
16.2
14.3
3.8
4.7
2.7
22.9
NI-FGSM (Ours)
I00.0
52.6
51.4
41.0
12.9
12.8
6.4
SI-NI-FGSM (Ours)
100.0
76.0
73.3
67.6
31.6
30.0
17.4
56.6
5 CONCLUSION AND FUTURE WORK
In this work, we propose two new attack methods, namely Nesterov Iterative Fast Gradient Sign Method (NI-FGSM) and Scale-Invarian attack Method (SIM), improve the transferability of ad- versarial examples. NI-FGSM aims to adopt Nesterov accelerated gradient method into the gradient- based attack, and SIM aims to achieve model augmentation by leveraging the scale-invariant prop- erty of models. NI-FGSM and SIM can be naturally combined to build robust attack, namely SI- NI-FGSM. Moreover, by integrating SI-NI-FGSM with the baseline attacks, we can further improve the transferability of adversarial examples. Extensive experiments demonstrate that methods not only yield higher success rates on adversarially trained models but also break other strong defense mechanism.

---

Published as a conference paper at ICLR 2020
Our work of NI-FGSM suggests that other momentum methods (e.g. Adam) may also be helpful to build a strong attack, which will be our future work, and the key is how to migrate the optimization method to the gradient-based iterative attack. Our work also shows that deep neural networks have the scale-invariant property, which we utilized to design the SIM to improve the attack transferabil- ity. However, it is not clear why the scale-invariant property holds. Possibly it is due the batch normalization at each convolutional layer, that may mitigate the impact of the scale change. We will also explore the reason more thoroughly in our future work.
ACKNOWLEDGMENTS
This work is supported by the Fundamental Research Funds for the Central Universities (2019()XXIC022I) and Microsoft Research Asia.
REFERENCES
Anurag Arnab, Ondrej Miksik, and Philip HS Torr. On the robustness of semantic segmentation models to adversarial attacks. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 388-897, 2018.
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 IEEE Symposium on Security and Privacy (SP), pp. 39-57, 2017.
Jeremy Cohen, Elan Rosenfeld, and Zico Kolter. Certified adversarial robustness via randomized smoothing. In International Conference on Machine Learning, pp. 1310-1320, 2019.
Yinpeng Dong, Fangzhou Liao, Tianyu Pang. Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boost- ing adversarial attacks with momentum. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 9185-9193, 2018.
Yinpeng Dong, Tianyu Pang, Hang Su, and Jun Zhu. Evading defenses to transferable adversarial examples by translation invariant attacks. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 2312-4321, 2019.
lan J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv: 1121v:1412.6572, 2014.
Chuan Guo, Mayank Rana, Moustapha Cisse, and Laurens van der Maaten. Countering adversarial images using input transformations. In International Conference Learning Representations, 2018.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Identity mappings in deep residual networks. In European conference on computer vision, pp. 630-645. Springer, 2016.
Xiaojun Jia, Xingxing Wei, Xiaochun Cao, and Hassan Foroosh. Comdefend: An efficient image compression model to defend adversarial examples. In Proceedings the IEEE Conference Computer Vision and Pattern Recognition, pp. 6084-6092, 2019.
Diederik P Kingma and Jimmy Ba. Adam: A method for stochastic optimization. arXiv preprint 14Xi::1412.69800 2014.
Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial examples in the physical world. arXiv preprint arXiv: 160.00237.,.33 2016.
Alexey Kurakin, Ian J. Goodfellow, and Samy Bengio. Adversarial machine learning scale. In International Conference Learning Representations, 2017.
Fangzhou Liao, Ming Liang, Yinpeng Dong, Tianyu Pang, Xiaolin Hu, and Jun Zhu. Defense against adversarial attacks using high-level representation guided denoiser. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 1778-1787, 2018.
Yanpei Liu, Xinyun Chen, Chang Liu, and Dawn Song. Delving into transferable adversarial exam- ples and black-box attacks. arXiv preprint arXiv: 1611:1771 2016.
10

---

Published as a conference paper at ICLR 2020
Zihao Liu, Qi Liu, Tao Liu, Nuo Xu, Xue Lin, Yanzhi Wang. and Wujie Wen. Feature distilla- tion: Dnn-oriented jpeg compression against adversarial examples. In Proceedings of the IEEE Conference Computer Vision and Pattern Recognition, pp. 860-868, 2019.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations, 2018.
Yurii Nesterov. method for unconstrained convex minimization problem with the rate of conver- gence (1/K3 2). In Doklady AN USSR, volume 269, pp. 543-547, 1983.
Boris T Polyak. Some methods of speeding up the convergence of iteration methods. USSR Com- putational Mathematics and Mathematical Physics, 4(5):1-17, 1964.
Olga Russakovsky, Jia Deng. Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma, Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael Bernstein, al. Imagenet large scale visual recognition challenge. International journal of computer vision, 115(3):211-55, 2015.
Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv: 1409. 1556, 2014.
Chuanbiao Song. Kun He, Liwei Wang, and John E. Hopcroft. Improving the generalization of adversarial training with domain adaptation. In International Conference Learning Represen- tations, 2019.
Chuanbiao Song, Kun He, Jiadong Lin, Liwei Wang, and John E. Hopcroft. Robust local features for improving the generalization of adversarial training. In International Conference on Learning Representations, 2020.
Ilya Sutskever, James Martens, George Dahl, and Geoffrey Hinton. On the importance of initial- ization and momentum in deep learning. In International conference on machine learning, pp. 1139-1147 2013.
Christian Szegedy, Google Inc, Wojeiech Zaremba, Ilya Sutskever, Google Inc, Joan Bruna, Dumitru Erhan, Google Inc, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. In International Conference on Learning Representations, Workshop Track, 2014.
Christian Szegedy, Vincent Vanhoucke, Sergey loffe, Jon Shlens, and Zbigniew Wojna. Rethink- ing the inception architecture for computer vision. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 2818-2826, 2016.
Christian Szegedy, Sergey loffe, Vincent Vanhoucke, and Alexander A Alemi. Inception-v4, inception-resnet and the impact of residual connections on learning. In Whirtt-FFrstt AAAI Confer- ence on Artificial Intelligence, 2017.
Florian Tramr, Alexey Kurakin, Nicolas Papernot, Ian Goodfellow, Dan Bonch, and Patrick Mc- Daniel. Ensemble adversarial training: Attacks and defenses. In International Conference on Learning Representations, 2018.
Xiaosen Wang, Kun He, and John E. Hopcroft. AT-GAN: A generative attack model for adversarial transferring on generative adversarial nets. CoRR, (bbs/1904.0779,, 2019.
Cihang Xie, Jianyu Wang, Zhishuai Zhang, Zhou Ren, and Alan Yuille. Mitigating adversarial effects through randomization. In International Conference on Learning Representations, 2018.
Cihang Xie, Zhishuai Zhang, Yuyin Zhou, Song Bai, Jianyu Wang, Zhou Ren, and Alan L Yuille. Improving transferability of adversarial examples with input diversity. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 2730-2739, 2019.
Runtian Zhai, Tianle Cai, Di He, Chen Dan, Kun He, John E. Hopcroft, and Liwei Wang. Adversar- ially robust generalization just requires more unlabeled data. CoRR, abs/1906.00 00555, 2019.
11

---

Published as a conference paper at ICLR 2020
A DETAILS OF THE ALGORITHMS
The algorithm of SI-NI-TI-DIM attack is summarized in Algorithm 2 We can get the SI-NI-DIM attack algorithm by removing Step 10 of Algorithm 2 removing T::p) in Step of Algorithm
and get the SI-NI-TIM attack algorithm by
Algorithm 2 SI-NI-TI-DIM
Input: A clean example with ground-truth label y'rue; classifier f with loss function J; Input: Perturbation size 6; maximum iterations T; number scale copies m and decay factor ja.
Output: An adversarial example addv
I: a c/T
2: 9o = 0,
3: for to T do
4:
5: Get x7 by Eq.
make a jump in the direction of previous accumulated gradients D sum the gradients over the scale copies of the input image Get the gradicnts by (T P), grree) > apply random resizing and padding
6: i= 0 to
do
7:
to the inputs with the probability p
8:
Sum the gradients as g = g + V (x)"))))))))))))))))))))))))))))
9:
Get average gradients g
9
10:
Convolve the gradients by g = W g convolve gradient with the pre-defined kernel W
11:
Update 9++1 by I++1 μ 9r Iall
12:
Update zadv by Eq.
13:
return add IT
ado
B VISUALIZATION OF ADVERSARIAL EXAMPLES
We visualize 12 randomly selected benign images and their corresponding adversarial images in Figure 3 The adversarial images are crafted on the ensemble models, including Inc-v3, Inc-v4, IncRes-v2 and Res-101, using the proposed SI-NI-TI-DIM. We see that these generated adversarial perturbations are human imperceptible.
benign
adversarial
benign
adversarial
Figure 3: Visualization of randomly picked benign images and their corresponding adversarial im-
ages, crafted on the ensemble models using SI-NI-TI-DIM.
12


Reviews:
[{"review_id": "SyxQje86tr", "reviewer": "AnonReviewer3", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "In this paper, the authors apply the Nesterov Accelerated Gradient method to the adversarial attack task and achieve better transferability of the adversarial examples. Furthermore, the authors introduce a scale transformation method to provide the augmentation on the model, which also boosts the transferability of the attack method. Experiments are carried out to verify the scale-invariant property and the Nesterov Accelerated Gradient method on both single and ensemble of models. All experiments turn out to be a positive support to the authors' claim.\n\nHowever, one small drawback of this paper is that the author does not claim any comparison between the Nesterov Accelerated Gradient Method and other momentum methods (e.g. Adam, momentum-SGD, etc). This experiment is somehow important since it shows the better transformability is obtained from 1) Nesterov Accelerated Gradient Method only, or 2) all momentum method, which is significant for further research.\n\nAlso, in the setting of the Scale-Invariant Transformation, the authors forget to address that what if the attacked network has an input normalization. Does it mean to downsample the value of each pixel in the input image? If so, is the equation $S_i(x) = x / 2^i$ better to be $S_i(x) = [x / 2^i]$ where $[]$ means casting to the nearest integer? \n\nOne more question of this work is:  The Nesterov Accelerated Gradient method is known for its proveable fast descent property comparing to the traditional Gradient method. Do you observe any speed-up during your training? ", "extra_scores": {"experience_assessment": "I have read many papers in this area.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper thoroughly.", "review_assessment:_checking_correctness_of_experiments": "I assessed the sensibility of the experiments.", "review_assessment:_checking_correctness_of_derivations_and_theory": "I carefully checked the derivations and theory."}, "extra_text": {}}, {"review_id": "HJl0R8y5KB", "reviewer": "AnonReviewer2", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This paper studies how to generate transferable adversarial examples for black-box attacks. Two methods have been proposed,  namely Nesterov Iterative Fast Gradient Sign Method (NI-FGSM) and Scale-Invariant attack Method (SIM). The first method adopts Nesterov optimizer instead of momentum optimizer to generate adversarial examples. And the second is a model-augmentation method to avoid \"overfitting\" of the adversarial examples. Experiments on ImageNet can prove the effectiveness of the proposed methods.\n\nOverall, this paper is well-written. The motivation of the proposed methods are generally clear although I have some questions. The experiments can generally prove the effectiveness.\n\nMy detailed questions about this paper are:\n1. The motivation in Section 3.1, which regards generating adversarial examples as training models, and transferability as generalizability, is first introduced in Dong et al. (2018). The authors should acknowledge and refer to the previous work to present the motivation.\n2. It's not clear why deep neural networks have the scale-invariant property. Is it due to that a batch normalization layer is usually applied after the first conv layer to mitigate the effect of scale change?\n3. It's not fair to directly compare DIM with SI-NI-DIM (also TIM vs. SI-NI-TIM; TI-DIM vs. SI-NI-TI-DIM), since SI-NI needs to calculate the gradient over 5 ensembles. It's better to compare the performance of two methods with the same number of gradient calculations.\n4. Is there an efficient way of calculating the gradient for scale-invariant attacks like translation-invariant attacks in Dong et al. (2019)? ", "extra_scores": {"experience_assessment": "I have published in this field for several years.", "review_assessment:_checking_correctness_of_derivations_and_theory": "N/A", "review_assessment:_checking_correctness_of_experiments": "I carefully checked the experiments.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper thoroughly."}, "extra_text": {}}, {"review_id": "BygheOf79r", "reviewer": "AnonReviewer1", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "In this paper, the authors proposed two methods of Nesterov Iterative Fast Gradient Sign Method (NI-FGSM) and Scale-Invariant attack Method (SIM) to improve the transferability of adversarial examples. Empirical results on ImageNet dataset demonstrate its effectiveness. In general, the paper is clearly written and easy to follow but I still have several concerns:\n1.\tAlthough the method is easy to understand, the authors are expected to clarify why the methods can improve the transferability. The authors are expected to make more theoretical analysis.\n2.\tThe authors are expected to make more comprehensive comparisons with the recent methods in adversarial attacks, e.g, PGD, and C&W even if some methods are designed for white-box attack. \n3.\tThe authors are expected to make more evaluations on the models with defense mechanism, and numerous important methods are missing. Without this, the authors cannot claim its effectiveness since only experiments on NIPS2017 is not enough.    \n", "extra_scores": {"experience_assessment": "I have published in this field for several years.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper thoroughly.", "review_assessment:_checking_correctness_of_experiments": "I assessed the sensibility of the experiments.", "review_assessment:_checking_correctness_of_derivations_and_theory": "I carefully checked the derivations and theory."}, "extra_text": {}}]

Author rebuttal:

Meta-review: Under the optimization formulation of adversarial attack, this paper proposes two methods to improve the transferability of adversarial examples, namely Nesterov Iterative Fast Gradient Sign Method (NI-FGSM) and Scale-Invariant attack Method (SIM). NI-FGSM adapts Nesterov accelerated gradient into the iterative attacks to effectively look ahead and avoid the “missing” of the global maximum, and SIM optimizes the adversarial perturbations over the scale copies of the input images so as to avoid “overfitting” on the white-box model being attacked and generate more transferable adversarial examples. Empirical results demonstrate the effectiveness of the proposed methods. The ideas are sensible, and the empirical studies were strengthened during rebuttal.
Decision: Accept (Poster)