The Everywhere Attack is a method-agnostic scheme for boosting the targeted transferability of adversarial examples. Rather than optimizing one high-confidence instance of the target class for the whole image, it partitions the victim image into non-overlapping blocks and mounts a targeted attack on each block at once, planting 'an army of targets' across every local region. This mitigates attention inconsistency, the mismatch between which regions the surrogate model and the unknown victim model attend to, so the intended target class transfers more reliably. Because it only alters where the targeted loss is applied, it composes with existing transfer attacks (e.g. the Logit attack) and yields large gains in targeted transfer success on ImageNet and against real-world APIs.
Zeng and colleagues propose the 'Everywhere Attack', a method-agnostic scheme that improves the targeted transferability of adversarial examples in image classification. Adversarial transferability i…