Ranking Variance Reduced Ensemble Attack with Dual Optimization Surrogate Search

Deep neural networks have achieved remarkable success, but they are vulnerable to adversarial attacks. Previous studies have shown that combining transfer-based and query-based attacks in ensemble attacks can generate highly transferable adversarial examples. However, simply aggregating the output results of various models without considering the gradient variance among different models will lead to a suboptimal result. Moreover, fixed weights or inefficient methods for model weight updates can result in excessive query iterations. This paper proposes a novel method called Ranking Variance Reduced Ensemble attack with Dual Optimization surrogate search (RVREDO) as an enhanced ensemble attack method for improving adversarial transferability. Specifically, RVREDO mitigate the influence of gradient variance among models to improve the attack success rate of generated adversarial examples during the attack process. Simultaneously, a dual optimization weight updating strategy is employed to dynamically adjust the surrogate weight set, enhancing the efficiency of perturbation optimization. Experimental results on the ImageNet dataset demonstrate that our method outperforms previous state-of-the-art methods in terms of both attack success rate and average number of queries.