Transferability of adversarial examples is of central importance for attacking an unknown model, which facilitates adversarial attacks in more practical scenarios, e.g., blackbox attacks. Existing transferable attacks tend to craft adversarial examples by indiscriminately distorting features to degrade prediction accuracy in a source model without aware of intrinsic features of objects in the images. We argue that such brute-force degradation would introduce model-specific local optimum into adversarial examples, thus limiting the transferability. By contrast, we propose the Feature Importance-aware Attack (FIA), which disrupts important object-aware features that dominate model decisions consistently. More specifically, we obtain feature importance by introducing the aggregate gradient, which averages the gradients with respect to feature maps of the source model, computed on a batch of random transforms of the original clean image. The gradients will be highly correlated to objects of interest, and such correlation presents invariance across different models. Besides, the random transforms will preserve intrinsic features of objects and suppress model-specific information. Finally, the feature importance guides to search for adversarial examples towards disrupting critical features, achieving stronger transferability. Extensive experimental evaluation demonstrates the effectiveness and superior performance of the proposed FIA, i.e., improving the success rate by 8.4% against normally trained models and 11.7% against defense models as compared to the state-of-the-art transferable attacks. Code is available at: https://github.com/hcguoO0/FIA
翻译:对抗性实例的可转让性对于打击一种在更实际的情景中,例如黑盒袭击中便利对抗性攻击的未知模式至关重要。现有的可转让袭击往往通过不加区分的扭曲性特征来形成对抗性实例,从而降低源模型预测的准确性,而没有意识到图像中天体的内在特征。我们争辩说,这种布鲁特力退化将引入针对特定模型的当地最佳范例,从而限制可转让性。相比之下,我们建议采用特质重要性攻击(FIA),它破坏了在更实际的情景中,例如黑盒袭击。更具体地说,我们通过引入总梯度获得显著重要性,该梯度在源模型特征图上平均使用梯度,在原始清洁图像的随机转换中计算出源模型的特征图的精确性。这种粗力退化将与对象高度关联,这种关联性将在不同模型中产生差异。此外,随机变化将保留物体的内在特征并抑制特定模型的信息。最后,通过引入总体梯度梯度梯度,我们通过引入总体梯度梯度,在源模型上平均梯度上对梯度图的梯度图图进行平均梯度的梯度的梯度上测,A值上显示A-通常比A-FIA/FIA/IAAAA值的成功率的高级性评估,以比AAAA/IACRA/CRA/CRA/CRBRBRBRBRBSBA/CRA/CRMA/CRBA/CRMRMRBRMRMR的进度,通常比。