Generating Adversarial Samples Based on the Attack Robust Training Model

In this paper, we study the problem of black-box attack and propose a new adversarial sample generation framework to attack the robust trained model (ARTM). Iterative methods can cause serious overfitting problems because they only consider the optimality of a single adversarial sample and ignore the entire sample distribution. The generative approach maps the entire original sample distribution to the target model attack space. However, such methods are also limited by the similarity of the decision boundary between the substitute model and the target model, and the difference of the boundary will affect the adversarial sample transferability. Hence, we aim to mitigate this impact by adjusting the decision boundaries of the substitute model. Through robustness training, the model decision boundary is smoother, and the distribution of adversarial samples will reduce some noise and become more concentrated. This also makes the substitute model boundary more similar to the target model, thus improving the transferability of adversarial sample. Our proposed framework offers a fresh perspective for adversarial sample generation and robust training. The experimental results based on the ImageNet dataset show that our method is effective.