Adversarial examples have raised widespread attention in security-critical applications because of their transferability across different models. Although many methods have been proposed to boost adversarial transferability, a gap still exists in the practical demand. In this paper, we argue that the model-specific discriminative regions are a key factor to cause the over-fitting to the source model, and thus reduce the transferability to the target model. For that, a patch-wise mask is utilized to prune the model-specific regions when calculating adversarial perturbations. To accurately localize these regions, we present a learnable approach to optimize the mask automatically. Specifically, we simulate the target models in our framework, and adjust the patch-wise mask according to the feedback of simulated models. To improve the efficiency, Differential Evolutionary (DE) algorithm is utilized to search for patch-wise masks for a specific image. During iterative attacks, the learned masks are applied to the image to drop out the patches related to model-specific regions, thus making the gradients more generic and improving the adversarial transferability. The proposed approach is a pre-processing method and can be integrated with existing gradient-based methods to further boost the transfer attack success rate. Extensive experiments on the ImageNet dataset demonstrate the effectiveness of our method. We incorporate the proposed approach with existing methods in the ensemble attacks and achieve an average success rate of 93.01% against seven advanced defense methods, which can effectively enhance the state-of-the-art transfer-based attack performance.

翻译：对抗样本因其跨模型的可迁移性在安全关键应用中引起了广泛关注。尽管已有诸多方法被提出以提升对抗样本的可迁移性，但实际需求之间仍存在差距。本文提出，模型特有的判别区域是导致对源模型过拟合、进而降低向目标模型迁移性的关键因素。为此，我们利用一种分块掩码在计算对抗扰动时剪除模型特有区域。为实现对这些区域的精确定位，我们提出一种可学习方法来自动优化该掩码。具体而言，我们在框架中模拟目标模型，并根据模拟模型的反馈调整分块掩码。为提升效率，采用差分进化算法为特定图像搜索分块掩码。在迭代攻击过程中，将学习到的掩码应用于图像，以丢弃与模型特有区域相关的图像块，从而使梯度更具通用性并提升对抗可迁移性。所提方法作为一种预处理技术，可与现有基于梯度的方法集成，进一步提升迁移攻击的成功率。在ImageNet数据集上的大量实验证明了我们方法的有效性。我们将所提方法与现有方法结合进行集成攻击，针对七种先进防御方法实现了93.01%的平均成功率，有效增强了当前最先进的基于迁移的攻击性能。