Improving Adversarial Transferability with Local Perturbation Augmentation
This paper reveals that the iterative optimization process tends to over-specialize adversarial perturbations to the local gradient characteristics of the surrogate model, thereby hindering their transferability to other models, and proposes a novel attack method called Local Perturbation Augmentation Attack.