Thank you for the valuable review
Thank you for the supportive review. We are encouraged by the appreciation of the novelty, clarity, and thorough experiments of this paper. We have uploaded a revision of our paper. Below we address the detailed comments, and hope that you may find our response satisfactory.
***Question 1: The performance of CWA only.***
Thank you for the suggestion. We further conduct experiments of SAM, CSE, and CWA without integrating with other methods. The detailed results are shown in Table C.5 in Appendix C.7. The average performance of different methods over all black-box models are shown below.
| Method | FGSM | BIM | MI | SAM | CSE | CWA | MI-SAM | MI-SCE | MI-CWA |
| :-----: | :-----: | :-----: | :-----: | :-----: | :-----: | :-----: | :-----: | :-----: | :-----: |
| Attack success rate (\%) | 50.89 | 63.71 | 71.65 | 73.38 | 85.85 | 82.55 | 77.92 | 90.68 | 90.76 |
It can be seen that SAM, CSE, and CWA outperform the baselines FGSM, BIM, and MI by a large margin. However, their performance is inferior to their counterparts with MI, indicating that our methods and MI are orthogonal and can be integrated together to further improve the performance.
***Question 2: Different norm decomposition.***
Thank you for the suggestion. It is true that we can decompose the second-order term $(\boldsymbol{x}-\boldsymbol{p}_i)^\top \boldsymbol{H}_i (\boldsymbol{x}-\boldsymbol{p}_i)$ with different norms (see Appendix A.1 for a more general result). However, with a different norm of $\boldsymbol{H}_i$, it is hard to interpret the meaning of minimizing this norm, and we can hardly associate it with generalization/transferability of adversarial examples. Besides, we need to calculate the third-order derivative of the loss function w.r.t. input $\boldsymbol{x}$, which would be intractable for deep neural networks. Therefore, it is hard to deal with other norms of $\boldsymbol{H}_i$, and we only focus on the Frobenius norm of $\boldsymbol{H}_i$ with a clear connection to loss flatness and an alternative method based on sharpness aware minimization for optimization.
***Question 3: Clarify the novelty compared to the previous methods.***
The main novelty of this paper lies in a new adversarial attack method from the perspective of model ensembling. Specifically, we use a quadratic approximation of the loss function and discover that the second-order term can be upper bounded by the product of the Frobenius norm of the Hessian matrix and the distance to the local optimum of each model. Therefore, we propose a common weakness attack to minimize the upper bound with great effectiveness. The existing attacks (e.g., MI, VMI, SSA) mainly focus on developing optimization algorithms or data augmentation techniques to improve transferability, while do not consider model ensembling in adversarial attacks. The sharpness aware minimization (SAM) is commonly used to train deep neural networks, but we extend it to adversarial attacks to improve the transferability based on our analysis.
***Question 4: Why is the method more effective for adversarial trained model?***
The main reason is that our method can better exploit the vulnerabilities of different surrogate models in the ensemble by finding their common weakness. As we included two adversarially trained models (which are publicly available by [1,2]) in the ensemble, the adversarial examples generated by our method can better transfer to attack other black-box adversarially trained models. But for baseline attacks that directly average different surrogate models, they tend to attack easier models (i.e., normally trained models) [3], such that the useful gradient information would be overwhelmed by these normal models, leading to inferior results for adversarially trained models.
**Reference:**
[1] Salman et al., Do adversarially robust imagenet models transfer better? NeurIPS 2020.
[2] Debenedett et al., A light recipe to train robust vision
transformers. IEEE Conference on Secure and Trustworthy Machine Learning, 2023.
[3] Dong et al., Discovering adversarial examples with momentum, https://arxiv.org/abs/1710.06081v1.