In recent years, the security of deep learning models achieves more and more attentions with the rapid development of neural networks, which are vulnerable to adversarial examples. Almost all existing gradient-based attack methods use the sign function in the generation to meet the requirement of perturbation budget on $L_\infty$ norm. However, we find that the sign function may be improper for generating adversarial examples since it modifies the exact gradient direction. Instead of using the sign function, we propose to directly utilize the exact gradient direction with a scaling factor for generating adversarial perturbations, which improves the attack success rates of adversarial examples even with fewer perturbations. At the same time, we also theoretically prove that this method can achieve better black-box transferability. Moreover, considering that the best scaling factor varies across different images, we propose an adaptive scaling factor generator to seek an appropriate scaling factor for each image, which avoids the computational cost for manually searching the scaling factor. Our method can be integrated with almost all existing gradient-based attack methods to further improve their attack success rates. Extensive experiments on the CIFAR10 and ImageNet datasets show that our method exhibits higher transferability and outperforms the state-of-the-art methods.

翻译：在近年来，随着神经网络的快速发展，深度学习模型的安全性受到越来越多的关注，而这类模型极易受到对抗样本的攻击。几乎所有现有的基于梯度的攻击方法在生成对抗样本时都使用符号函数来满足$L_\infty$范数下的扰动预算约束。然而，我们发现符号函数可能会因改变精确梯度方向而不适合生成对抗样本。为此，我们提出放弃符号函数，转而直接利用精确梯度方向并乘以缩放因子来生成对抗扰动，该方法能在扰动更少的情况下提高对抗样本的攻击成功率。同时，我们从理论上证明该方法能实现更好的黑盒迁移性。此外，考虑到最佳缩放因子因图像而异，我们提出一种自适应缩放因子生成器，为每张图像自动寻找合适的缩放因子，从而避免了手动搜索缩放因子的计算开销。我们的方法可集成到几乎所有现有基于梯度的攻击方法中，进一步提升其攻击成功率。在CIFAR10和ImageNet数据集上的大量实验表明，我们的方法具有更高的迁移性，且性能优于当前最先进的方法。