Enhancing Transferability of Adversarial Examples Through Randomization in Generative Adversarial Training

Deep neural networks are vulnerable to adversar-ial examples, they can be deceived by adding imperceptible perturbations on benign inputs. Moreover, people exploit the transferability of adversarial examples to conduct black-box attacks, which means using adversarial examples constructed by surrogate models to deceive unknown models. In real-world scenarios, the network architecture and training dataset used by the victim model are unkonwn. The surrogate model and the victim model may employ different network structures and utilize distinct training datasets, thus impeding effective black-box attacks. While the current studies primarily focus on enhancing transferability across models, they have yet to achieve satisfactory transferability across both models and data domains simultaneously. In this paper, we employ a generative adversarial training framework which consists of a generator for constructing adversarial examples and a discriminator for identification. We innovatively introduce the concept of randomization throughout the entire training process to enhance the transferability of adversarial examples. Specifically, we employ random neural network weight pruning on the discriminator model during the training process, implicitly integrating a multitude of different discriminator models. This approach enhances the transferability of adversarial examples across models. Moreover, we apply random normalization to the dataset to address cross-domain transferability. Extensive experiments confirm the effectiveness of our method and adversarial examples generated using our approach exhibit high attack success rates in black-box attack scenarios.