Training Meta-Surrogate Model for Transferable Adversarial Attack

The problem of adversarial attacks to a black-box model when no queries are allowed has posed great challenge the community and been extensively investigated. In this setting, one simple yet effective method is transfer obtained examples from attacking surrogate models fool target model. Previous works have studied what kind can generate more transferable examples, but their performances still limited due mismatches between paper, we tackle novel angle---instead using original models, obtain Meta-Surrogate Model (MSM) such that be easily transferred other models? We show goal mathematically formulated as bi-level optimization design differentiable attacker make training feasible. Given or set our thus an MSM generated on enjoy eximious transferability. Comprehensive experiments Cifar-10 ImageNet demonstrate by MSM, stronger deceive including adversarially trained ones, with much higher success rates than existing methods.