Efficient and Transferable Adversarial Examples from Bayesian Neural
  Networks
  An established way to improve the transferability of black-box evasion
attacks is to craft the adversarial examples on a surrogate ensemble model to
increase diversity. We argue that transferability is fundamentally related to
epistemic uncertainty. Based on a state-of-the-art Bayesian Deep Learning
technique, we propose a new method to efficiently build a surrogate by sampling
approximately from the posterior distribution of neural network weights, which
represents the belief about the value of each parameter. Our extensive
experiments on ImageNet and CIFAR-10 show that our approach improves the
transfer rates of four state-of-the-art attacks significantly (up to 62.1
percentage points), in both intra-architecture and inter-architecture cases. On
ImageNet, our approach can reach 94% of transfer rate while reducing training
computations from 11.6 to 2.4 exaflops, compared to an ensemble of
independently trained DNNs. Our vanilla surrogate achieves 87.5% of the time
higher transferability than 3 test-time techniques designed for this purpose.
Our work demonstrates that the way to train a surrogate has been overlooked
although it is an important element of transfer-based attacks. We are,
therefore, the first to review the effectiveness of several training methods in
increasing transferability. We provide new directions to better understand the
transferability phenomenon and offer a simple but strong baseline for future
work.
