  Transfer-based attacks craft adversarial examples utilizing a white-box
surrogate model to compromise various black-box target models, posing
significant threats to many real-world applications. However, existing transfer
attacks suffer from either weak transferability or expensive computation. To
bridge the gap, we propose a novel sample-based attack, named neighborhood
conditional sampling (NCS), which enjoys high transferability with lightweight
computation. Inspired by the observation that flat maxima result in better
transferability, NCS is formulated as a max-min bi-level optimization problem
to seek adversarial regions with high expected adversarial loss and small
standard deviations. Specifically, due to the inner minimization problem being
computationally intensive to resolve, and affecting the overall
transferability, we propose a momentum-based previous gradient inversion
approximation (PGIA) method to effectively solve the inner problem without any
computation cost. In addition, we prove that two newly proposed attacks, which
achieve flat maxima for better transferability, are actually specific cases of
NCS under particular conditions. Extensive experiments demonstrate that NCS
efficiently generates highly transferable adversarial examples, surpassing the
current best method in transferability while requiring only 50% of the
computational cost. Additionally, NCS can be seamlessly integrated with other
methods to further enhance transferability.
