DiversityCanBeTransferred: OutputDiversification for White-andBlack-boxAttacks

Adversarial attacks ofteninvolverandom perturbations oftheinputsdrawnfrom uniform or Gaussian distributions, e.g., to initialize optimization-based whitebox attacks or generate update directions in black-box attacks. These simple perturbations, however, could be sub-optimal as they are agnostic to the model being attacked.