Adversarial example soups: averaging multiple adversarial examples
  improves transferability without increasing additional generation time
Bo Yang Hengwei Zhang Chenwei Li Jindong Wang
For transfer-based attacks, the adversarial examples are crafted on the
surrogate model, which can be implemented to mislead the target model
effectively. The conventional method for maximizing adversarial transferability
involves: (1) fine-tuning hyperparameters to generate multiple batches of
adversarial examples on the substitute model; (2) conserving the batch of
adversarial examples that have the best comprehensive performance on substitute
model and target model, and discarding the others. In this work, we revisit the
second step of this process in the context of fine-tuning hyperparameters to
craft adversarial examples, where multiple batches of fine-tuned adversarial
examples often appear in a single high error hilltop. We demonstrate that
averaging multiple batches of adversarial examples under different
hyperparameter configurations, which refers to as "adversarial example soups",
can often enhance adversarial transferability. Compared with traditional
methods, the proposed method incurs no additional generation time and
computational cost. Besides, our method is orthogonal to existing
transfer-based methods and can be combined with them seamlessly to generate
more transferable adversarial examples. Extensive experiments on the ImageNet
dataset show that our methods achieve a higher attack success rate than the
state-of-the-art attacks.