To help adversarial examples generalize from surrogate machine-learning (ML) models to targets, certain transferability-based black-box evasion attacks incorporate data augmentations (e.g., random resizing). Yet, prior work has explored limited augmentations and their composition. To fill the gap, we systematically studied how data augmentation affects transferability. Specifically, we explored 46 augmentation techniques originally proposed to help ML models generalize to unseen benign samples, and assessed how they impact transferability, when applied individually or composed. Performing exhaustive search on a small subset of augmentation techniques and genetic search on all techniques, we identified augmentation combinations that help promote transferability. Extensive experiments with the ImageNet and CIFAR-10 datasets and 18 models showed that simple color-space augmentations (e.g., color to greyscale) attain high transferability when combined with standard augmentations. Furthermore, we discovered that composing augmentations impacts transferability mostly monotonically (i.e., more augmentations $\rightarrow$ $\ge$transferability). We also found that the best composition significantly outperformed the state of the art (e.g., 91.8% vs. $\le$82.5% average transferability to adversarially trained targets on ImageNet). Lastly, our theoretical analysis, backed by empirical evidence, intuitively explains why certain augmentations promote transferability.

翻译：为帮助对抗样本从替代机器学习模型泛化至目标模型，某些基于可迁移性的黑盒规避攻击采用了数据增强技术（如随机尺寸调整）。然而，先前研究仅探索了有限的增强方法及其组合方式。为填补这一空白，我们系统性地研究了数据增强如何影响可迁移性。具体而言，我们探究了46种最初为提升机器学习模型对未见良性样本泛化能力而设计的增强技术，并评估了这些技术在单独使用或组合应用时对可迁移性的影响。通过对增强技术子集进行穷举搜索，并对全部技术实施遗传搜索，我们识别出能够有效提升可迁移性的增强组合。在ImageNet和CIFAR-10数据集及18个模型上的大量实验表明，简单的色彩空间增强（如彩色转灰度）与标准增强技术结合时可实现较高的可迁移性。此外，我们发现增强技术的组合对可迁移性的影响呈现近似单调性（即更多增强技术→≥可迁移性）。实验还表明，最优组合的性能显著优于现有最佳方法（例如在ImageNet数据集上，针对对抗训练目标模型的平均可迁移率达到91.8%，而现有方法≤82.5%）。最后，我们结合实证证据的理论分析，直观阐释了特定增强技术提升可迁移性的内在机理。