  Deep neural networks are vulnerable to adversarial examples, which are
crafted by applying small, human-imperceptible perturbations on the original
images, so as to mislead deep neural networks to output inaccurate predictions.
Adversarial attacks can thus be an important method to evaluate and select
robust models in safety-critical applications. However, under the challenging
black-box setting, most existing adversarial attacks often achieve relatively
low success rates on adversarially trained networks and advanced defense
models. In this paper, we propose AdaBelief Iterative Fast Gradient Method
(ABI-FGM) and Crop-Invariant attack Method (CIM) to improves the
transferability of adversarial examples. ABI-FGM and CIM can be readily
integrated to build a strong gradient-based attack to further boost the success
rates of adversarial examples for black-box attacks. Moreover, our method can
also be naturally combined with other gradient-based attack methods to build a
more robust attack to generate more transferable adversarial examples against
the defense models. Extensive experiments on the ImageNet dataset demonstrate
the method's effectiveness. Whether on adversarially trained networks or
advanced defense models, our method has higher success rates than
state-of-the-art gradient-based attack methods.
