We propose transferability from Large Geometric Vicinity (LGV), a new technique to increase the transferability of black-box adversarial attacks. LGV starts from a pretrained surrogate model and collects multiple weight sets from a few additional training epochs with a constant and high learning rate. LGV exploits two geometric properties that we relate to transferability. First, models that belong to a wider weight optimum are better surrogates. Second, we identify a subspace able to generate an effective surrogate ensemble among this wider optimum. Through extensive experiments, we show that LGV alone outperforms all (combinations of) four established test-time transformations by 1.8 to 59.9 percentage points. Our findings shed new light on the importance of the geometry of the weight space to explain the transferability of adversarial examples.
@article{arxiv.2207.13129,
title = {LGV: Boosting Adversarial Example Transferability from Large Geometric Vicinity},
author = {Martin Gubri and Maxime Cordy and Mike Papadakis and Yves Le Traon and Koushik Sen},
journal= {arXiv preprint arXiv:2207.13129},
year = {2022}
}