  Crafting adversarial examples for the transfer-based attack is challenging
and remains a research hot spot. Currently, such attack methods are based on
the hypothesis that the substitute model and the victim's model learn similar
decision boundaries, and they conventionally apply Sign Method (SM) to
manipulate the gradient as the resultant perturbation. Although SM is
efficient, it only extracts the sign of gradient units but ignores their value
difference, which inevitably leads to a serious deviation. Therefore, we
propose a novel Staircase Sign Method (S$^2$M) to alleviate this issue, thus
boosting transfer-based attacks. Technically, our method heuristically divides
the gradient sign into several segments according to the values of the gradient
units, and then assigns each segment with a staircase weight for better
crafting adversarial perturbation. As a result, our adversarial examples
perform better in both white-box and black-box manner without being more
visible. Since S$^2$M just manipulates the resultant gradient, our method can
be generally integrated into any transfer-based attacks, and the computational
overhead is negligible. Extensive experiments on the ImageNet dataset
demonstrate the effectiveness of our proposed methods, which significantly
improve the transferability (i.e., on average, \textbf{5.1\%} for normally
trained models and \textbf{11.2\%} for adversarially trained defenses). Our
code is available at:
\url{https://github.com/qilong-zhang/Staircase-sign-method}.
