Abstract: Although adversarial attacks have achieved incredible attack success rates
under the white-box setting, most existing adversaries often exhibit weak
transferability under the black-box setting. To address this issue, various
input transformations have been proposed to enhance the attack transferability.
In this work, We observe that all the existing transformations are applied on a
single image, which might limit the transferability of the crafted adversaries.
Hence, we propose a new input transformation based attack called Admix Attack
Method (AAM) that considers both the original image and an image randomly
picked from other categories. Instead of directly calculating the gradient on
the original input, AAM calculates the gradient on the admixed image
interpolated by the two images in order to craft adversaries with higher
transferablility. Empirical evaluations on the standard ImageNet dataset
demonstrate that AAM could achieve much higher transferability than the
existing input transformation methods. By incorporating with other input
transformations, our method could further improve the transferability and
outperform the state-of-the-art combination of input transformations by a clear
margin of 3.4% on average when attacking nine advanced defense models.