Deep learning models are vulnerable to adversarial examples crafted by applying human-imperceptible perturbations on benign inputs. However, under the blackbox setting, most existing adversaries often have a poor transferability to attack other defense models. In this work, from the perspective of regarding the adversarial example generation as an optimization process, we propose two new methods to improve the transferability of adversarial examples, namely Nesterov Iterative Fast Gradient Sign Method (NI-FGSM) and Scale-Invariant attack Method (SIM). NI-FGSM aims to adapt Nesterov accelerated gradient into the iterative attacks so as to effectively look ahead and improve the transferability of adversarial examples. While SIM is based on our discovery on the scale-invariant property of deep learning models, for which we leverage to optimize the adversarial perturbations over the scale copies of the input images so as to avoid "overfitting" on the white-box model being attacked and generate more transferable adversarial examples. NI-FGSM and SIM can be naturally integrated to build a robust gradient-based attack to generate more transferable adversarial examples against the defense models. Empirical results on ImageNet dataset demonstrate that our attack methods exhibit higher transferability and achieve higher attack success rates than state-of-the-art gradient-based attacks.
This paper studies how to generate transferable adversarial examples for black-box attacks. Two methods have been proposed,  namely Nesterov Iterative Fast Gradient Sign Method (NI-FGSM) and Scale-Invariant attack Method (SIM). The first method adopts Nesterov optimizer instead of momentum optimizer to generate adversarial examples. And the second is a model-augmentation method to avoid "overfitting" of the adversarial examples. Experiments on ImageNet can prove the effectiveness of the proposed methods.
Overall, this paper is well-written. The motivation of the proposed methods are generally clear although I have some questions. The experiments can generally prove the effectiveness.
My detailed questions about this paper are:
1. The motivation in Section 3.1, which regards generating adversarial examples as training models, and transferability as generalizability, is first introduced in Dong et al. (2018). The authors should acknowledge and refer to the previous work to present the motivation.
2. It's not clear why deep neural networks have the scale-invariant property. Is it due to that a batch normalization layer is usually applied after the first conv layer to mitigate the effect of scale change?
3. It's not fair to directly compare DIM with SI-NI-DIM (also TIM vs. SI-NI-TIM; TI-DIM vs. SI-NI-TI-DIM), since SI-NI needs to calculate the gradient over 5 ensembles. It's better to compare the performance of two methods with the same number of gradient calculations.
4. Is there an efficient way of calculating the gradient for scale-invariant attacks like translation-invariant attacks in Dong et al. (2019)?