Dynamic loss yielding more transferable targeted adversarial examples

Adversarial examples are known to have the property of transferability; as a result, deep neural networks can be compromised by transfer-based attacks in black-box scenarios. Recent studies have shown that targeted adversarial examples are far more difficult to transfer than untargeted adversarial examples. We find that the widely used pattern for targeted attacks (i.e., minimizing the loss with respect to the target label) is insufficient for the transfer scenario. To address this issue, we propose a dynamic loss to yield more transferable targeted adversarial examples. In each iteration of attack optimization, in addition to minimizing the loss with respect to the target label, we dynamically select the top k labels (excluding the target label) with high classification probability to penalize (i.e., maximize) their corresponding loss. As a result, the probability of adversarial examples being classified as target labels will be significantly higher than that of being classified as other labels. Extensive experiments on ImageNet and the Google Cloud Vision API show that the dynamic loss significantly outperforms the traditional loss. For example, in the ensemble-based transfer scenario, the dynamic Cross-Entropy (CE) loss can improve the transferability of targeted adversarial examples by 2∼6 times relative to the traditional CE loss. Code is available at https://github.com/mingcheung/Targeted-Transfer-with-Dynamic-Loss.