Rethinking Model Ensemble in Transfer-based Adversarial Attacks

arXiv:2303.09105v2 Announce Type: replace
Abstract: It is widely recognized that deep learning models lack robustness to adversarial examples. An intriguing property of adversarial examples is that they can transfer across different models, which enables black-box attacks without any knowledge of the victim model. An effective strategy to improve the transferability is attacking an ensemble of models. However, previous works simply average the outputs of different models, lacking an in-depth analysis on how and why model ensemble methods can strongly improve …

adversarial adversarial attacks arxiv attacks cs.cv ensemble transfer type