A Multi-Proxy Model Based Transfer Attack via Multi-Objective Optimization

Attackers can create adversarial samples by adding minor perturbations to clean samples, which may lead deep neural network models to make incorrect predictions. In the case of a black-box deep neural network model, transfer attacks rely on a proxy model to generate adversarial samples for attacking the target model. Nevertheless, due to the differences in decision boundaries between the proxy model and the target model, enhancing the transfer success rate of adversarial samples has emerged as a significant challenge. Previous research has demonstrated that training adversarial samples in parallel using multiple proxy models can improve the attack success rate. However, this approach incurs substantial computational costs. To this end, this paper proposes training adversarial samples serially using multiple proxy models and optimizing the sequence of these proxy models through a multi-objective optimization method. Specifically, we first construct a model set composed of multiple proxy models. Then, a certain number of models are randomly selected to form initial individuals, and each model is assigned a unique perturbation value. With the length of the proxy model sequence and the success rate of the transfer attack as the optimization objectives, we employ the multi-objective optimization algorithm NSGA-II to optimize the population. Through crossover and mutation operations, the model chains and perturbation value chains of individuals are exchanged and randomly generated. Eventually, the optimal model sequence can be utilized to train adversarial samples with a higher transfer success rate.