ABSTRACT Deep neural networks (DNNs) are highly susceptible to adversarial examples. By adding imperceptible perturbations to benign images, adversarial examples can mislead models into producing incorrect outputs, thereby posing significant security risks to DNN‐based applications. However, most existing adversarial attack methods still achieve limited attack success rates. Focusing on black‐box transfer attacks, we propose two novel approaches. First, TNI‐FGSM aggregates gradients from the forward, backward, and current directions, enabling more stable updates and yielding more optimal perturbation directions. Second, NRSM initially performs random sampling on the input, followed by neighborhood resampling on both sides of the previous iteration's gradient. This process captures richer information, facilitates the discovery of optimal local extrema, and enhances transferability. Experiments conducted on ImageNet across conventional CNNs, four types of vision Transformers, and robust models demonstrate that NRSM consistently outperforms baseline methods. When Inception‐v3 (Inc‐v3) is used as the local model, NRSM achieves attack success rates (ASRs) that are 11.9% and 15.4% higher than LETM on Swin and HGD, respectively. Under the ensemble setting, NRSM attains an average ASR of 96.5%, surpassing Admix by 6.1%. Code is available at https://github.com/BreenoWH/NRSM‐TNI .
ZHANG et al. (Wed,) studied this question.