Plentiful adversarial attack researches have revealed the fragility of deep neural networks (DNNs), where the imperceptible perturbations can cause drastic changes in the output. Among the diverse types of attack methods, gradient-based attacks are powerful and easy to implement, arousing wide concern for the security problem of DNNs. However, under the black-box setting, the existing gradient-based attacks have much trouble in breaking through DNN models with defense technologies, especially those adversarially trained models. To make adversarial examples more transferable, in this paper, we explore the fluctuation phenomenon on the plus-minus sign of the adversarial perturbations’ pixels during the generation of adversarial examples, and propose an ingenious Gradient Relevance Attack (GRA). Specifically, two gradient relevance frameworks are presented to better utilize the information in the neighbor-hood of the input, which can correct the update direction adaptively. Then we adjust the update step at each iteration with a decay indicator to counter the fluctuation. Experiment results on a subset of the ILSVRC 2012 validation set forcefully verify the effectiveness of GRA. Furthermore, the attack success rates of 68.7% and 64.8% on Tencent Cloud and Baidu AI Cloud further indicate that GRA can craft adversarial examples with the ability to transfer across both datasets and model architectures. Code is released at https://github.com/RYC-98/GRA.

Deep neural networks are highly susceptible to imperceptible noise, even to the human eye. While high attack success rate has been achieved in white-box setting, the attack performance tends to decline in black-box environments. To address this challenge, this study introduces a novel adaptive points selecting iterative fast gradient sign method, named AI-FGSM, which leverages temporal neighborhoods to enhance transferability performance in black-box environments. AI-FGSM is unique in that it extracts gradients from additional points in the temporal neighborhood and adjusts the current gradient using previous gradients to maintain the updated trend's stability. This gradient correction enables faster optimization and restricts falling into local optima. Experimental results on the ImageNet dataset show that AI-FGSM outperforms advanced gradient-based attack methods such as MI-FGSM and NI-FGSM in terms of attack success rate and transferability. Moreover, in black-box environments, AI-FGSM achieves an average attack performance improvement of 44.2% for some models with adversarial training and 32.9% for several models without adversarial training. These results confirm the performance and effectiveness of AI-FGSM, underscoring its potential as a powerful tool for improving the transferability of adversarial attacks.