Boosting the Adversarial Transferability of Surrogate Model with Dark
  Knowledge
  Deep neural networks (DNNs) for image classification are known to be
vulnerable to adversarial examples. And, the adversarial examples have
transferability, which means an adversarial example for a DNN model can fool
another black-box model with a non-trivial probability. This gave birth of the
transfer-based adversarial attack where the adversarial examples generated by a
pretrained or known model (called surrogate model) are used to conduct
black-box attack. There are some work on how to generate the adversarial
examples from a given surrogate model to achieve better transferability.
However, training a special surrogate model to generate adversarial examples
with better transferability is relatively under-explored. In this paper, we
propose a method of training a surrogate model with abundant dark knowledge to
boost the adversarial transferability of the adversarial examples generated by
the surrogate model. This trained surrogate model is named dark surrogate model
(DSM), and the proposed method to train DSM consists of two key components: a
teacher model extracting dark knowledge and providing soft labels, and the
mixing augmentation skill which enhances the dark knowledge of training data.
Extensive experiments have been conducted to show that the proposed method can
substantially improve the adversarial transferability of surrogate model across
different architectures of surrogate model and optimizers for generating
adversarial examples. We also show that the proposed method can be applied to
other scenarios of transfer-based attack that contain dark knowledge, like face
verification.
