Towards boosting black-box attack via sharpness-aware

For black-box attacks, we utilize the transferability of adversarial examples to attack the unseen model successfully. However, existing attack algorithms are easily trapped into a sharp maximum, where a small perturbation changes its value significantly, leading to the failure of the attack. To tackle this issue, we propose a novel Sharpness-Aware Attack seeking the adversarial example with a flat maximum. Specifically, we sample several poor adversarial examples from the neighborhoods of the current point and alleviate the sharpness between them. We also sample anticipatory neighborhoods examples to make the attack algorithm converge quickly to an excellent starting point. Extensive experiments on the ImageNet dataset show the effectiveness of our method, combined with existing gradient-based attacks, our method yields an average attack success rate of 70.0% for nine defense models.