LGV: Boosting Adversarial Example Transferability from Large Geometric Vicinity

We propose transferability from Large Geometric Vicinity (LGV), a new technique to increase the of black-box adversarial attacks. LGV starts pretrained surrogate model and collects multiple weight sets few additional training epochs with constant high learning rate. exploits two geometric properties that we relate transferability. First, models belong wider optimum are better surrogates. Second, identify subspace able generate an effective ensemble among this optimum. Through extensive experiments, show alone outperforms all (combinations of) four established test-time transformations by 1.8 59.9% points. Our findings shed light on importance geometry space explain examples.