{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/boosting-adversarial-transferability-by-1","title":"Boosting Adversarial Transferability by Achieving Flat Local Maxima","arxiv_id":"2306.05225","date":"2023-06-08","proceeding":"NeurIPS 2023 11","authors":["Zhijin Ge","Hongying Liu","Xiaosen Wang","Fanhua Shang","Yuanyuan Liu"],"abstract":"Transfer-based attack adopts the adversarial examples generated on the surrogate model to attack various models, making it applicable in the physical world and attracting increasing interest. Recently, various adversarial attacks have emerged to boost adversarial transferability from different perspectives. In this work, inspired by the observation that flat local minima are correlated with good generalization, we assume and empirically validate that adversarial examples at a flat local region tend to have good transferability by introducing a penalized gradient norm to the original loss function. Since directly optimizing the gradient regularization norm is computationally expensive and intractable for generating adversarial examples, we propose an approximation optimization method to simplify the gradient update of the objective function. Specifically, we randomly sample an example and adopt a first-order procedure to approximate the curvature of Hessian/vector product, which makes computing more efficient by interpolating two neighboring gradients. Meanwhile, in order to obtain a more stable gradient direction, we randomly sample multiple examples and average the gradients of these examples to reduce the variance due to random sampling during the iterative process. Extensive experimental results on the ImageNet-compatible dataset show that the proposed method can generate adversarial examples at flat local regions, and significantly improve the adversarial transferability on either normally trained models or adversarially trained models than the state-of-the-art attacks. Our codes are available at: https://github.com/Trustworthy-AI-Group/PGN.","url_abs":"https://arxiv.org/abs/2306.05225v2","url_pdf":"https://arxiv.org/pdf/2306.05225v2.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"boosting-adversarial-transferability-by-1","repo_url":"https://github.com/trustworthy-ai-group/pgn","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"MIT"}},{"paper_slug":"boosting-adversarial-transferability-by-1","repo_url":"https://github.com/Trustworthy-AI-Group/TransferAttack","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":null}],"tasks":[],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2306.05225","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2306.05225"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"deterministic:regex_extraction","url":"https://github.com/Trustworthy-AI-Group/PGN","reach":{"status":"ok","spdx":"MIT"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/Trustworthy-AI-Group/TransferAttack","reach":null},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/trustworthy-ai-group/pgn","reach":{"status":"ok","spdx":"MIT"}}],"summary":{"ran_draft_wrong":2,"unverified":4},"by_repo_kind":{"official":{"samples":5,"ran":2,"repositories":1},"listed":{"samples":1,"ran":0,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"11d8e1b97b2f5801","entry":"clip_by_tensor","repo":"trustworthy-ai-group/pgn","repo_kind":"official","path":"Incv3_PGN_Attack.py","file_url":"https://github.com/trustworthy-ai-group/pgn/blob/HEAD/Incv3_PGN_Attack.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":2,"contract_check":"MISDECLARED","metamorphic_tier":"invariant","behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"11d8e1b97b2f5801"}},{"code_sha256_prefix":"0a766042bf6022ec","entry":"get_loss_vale","repo":"trustworthy-ai-group/pgn","repo_kind":"official","path":"surface_map.py","file_url":"https://github.com/trustworthy-ai-group/pgn/blob/HEAD/surface_map.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"MISDECLARED","metamorphic_tier":"invariant","behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"0a766042bf6022ec"}},{"code_sha256_prefix":"f9420b942df48b64","entry":"PGN","repo":"trustworthy-ai-group/pgn","repo_kind":"official","path":"Incv3_PGN_Attack.py","file_url":"https://github.com/trustworthy-ai-group/pgn/blob/HEAD/Incv3_PGN_Attack.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"f9420b942df48b64"}},{"code_sha256_prefix":"1f660e705b2ca316","entry":"PGN","repo":"Trustworthy-AI-Group/TransferAttack","repo_kind":"listed","path":"transferattack/gradient/pgn.py","file_url":"https://github.com/Trustworthy-AI-Group/TransferAttack/blob/HEAD/transferattack/gradient/pgn.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"1f660e705b2ca316"}},{"code_sha256_prefix":"d77028adbe239e8f","entry":"PGN","repo":"trustworthy-ai-group/pgn","repo_kind":"official","path":"Incv3_PGN_Attack.py","file_url":"https://github.com/trustworthy-ai-group/pgn/blob/HEAD/Incv3_PGN_Attack.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"d77028adbe239e8f"}},{"code_sha256_prefix":"e0059efdf9164193","entry":"img2torch","repo":"Trustworthy-AI-Group/PGN","repo_kind":"official","path":"surface_map.py","file_url":"https://github.com/Trustworthy-AI-Group/PGN/blob/HEAD/surface_map.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"e0059efdf9164193"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}