Reliable Evaluation of Adversarial Transferability
Wenqian Yu Jindong Gu Zhijiang Li Philip Torr
Adversarial examples (AEs) with small adversarial perturbations can mislead
deep neural networks (DNNs) into wrong predictions. The AEs created on one DNN
can also fool another DNN. Over the last few years, the transferability of AEs
has garnered significant attention as it is a crucial property for facilitating
black-box attacks. Many approaches have been proposed to improve adversarial
transferability. However, they are mainly verified across different
convolutional neural network (CNN) architectures, which is not a reliable
evaluation since all CNNs share some similar architectural biases. In this
work, we re-evaluate 12 representative transferability-enhancing attack methods
where we test on 18 popular models from 4 types of neural networks. Our
reevaluation revealed that the adversarial transferability is often
overestimated, and there is no single AE that can be transferred to all popular
models. The transferability rank of previous attacking methods changes when
under our comprehensive evaluation. Based on our analysis, we propose a
reliable benchmark including three evaluation protocols. Adversarial
transferability on our new benchmark is extremely low, which further confirms
the overestimation of adversarial transferability. We release our benchmark at
https://adv-trans-eval.github.io to facilitate future research, which includes
code, model checkpoints, and evaluation protocols.