State-of-the-art deep neural networks are vulnerable to adversarial examples, formed by applying small but malicious perturbations to the original inputs. Moreover, the perturbations can transfer across models: adversarial examples generated for a specific model will often mislead other unseen models. Consequently the adversary can leverage it to attack deployed systems without any query, which severely hinders the application of deep learning, especially in the safety-critical areas. In this work, we empirically study how two classes of factors those might influence the transferability of adversarial examples. One is about model-specific factors, including network architecture, model capacity and test accuracy. The other is the local smoothness of loss surface for constructing adversarial examples. Inspired by these understandings on the transferability of adversarial examples, we then propose a simple but effective strategy to enhance the transferability, whose effectiveness is confirmed by a variety of experiments on both CIFAR-10 and ImageNet datasets.
The paper explores how the architecture, smoothness of the decision boundary and test accuracy of a model impacts the transferability of examples produced from it.  The paper provides a couple of novel insights, such as the asymmetry when transferring adversarial examples from one model to another. In addition, a novel method is proposed to enhance the transferability of adversarial examples from any model, through using smoothed gradients.
The experiments seem to show that the effect is rather large, and also makes the examples more robust to other transformations such as JPEG compression. Overall, these are interesting insights that could lead to further developments in making models more robust to adversarial examples. In particular, deriving adversarial examples that are both transferable and resilient to certain usual image transformations shows that the scope of the issue with adversarial examples may be even greater than what is understood today.
The paper is rather clear. Unfortunately, it is riddled with grammatical errors and should be proof-read carefully. A lot of singular/plurals are off, and some formulations are odd or downright unclear. Some examples (there are way too many to report them all):
- "Transfer-based attackS ... since they ...*
- "of adversarial exampleS ..."
- "from model A can transfer to model B"
- "less transferable than *those from* a shallow model"?
- "investigations, We ": don't capitalize
- "the averaging *has* a smoothing effect"
- "our motivation are"
- "contributed it to"
- "available *to the* adversary"
- "crafting adversarial perturbationS"
- "directly evaluation"
- "be fixed 100"
Pros:
- Transferability and robustness of adversarial examples is a very important problem
- Interesting insights, esp. the construction and evaluation of examples that are more resilient to certain image transformations
- Experimental results are convincing
Cons:
- Contribution overall may be a bit limited
- Grammatical errors and odd formulations all over the place