Although great progress has been made on adversarial attacks for deep neural networks (DNNs), their transferability is still unsatisfactory, especially for targeted attacks. There are two problems behind that have been long overlooked: 1) the conventional setting of $T$ iterations with the step size of $\epsilon/T$ to comply with the $\epsilon$-constraint. In this case, most of the pixels are allowed to add very small noise, much less than $\epsilon$; and 2) usually manipulating pixel-wise noise. However, features of a pixel extracted by DNNs are influenced by its surrounding regions, and different DNNs generally focus on different discriminative regions in recognition. To tackle these issues, we propose a patch-wise iterative method (PIM) aimed at crafting adversarial examples with high transferability. Specifically, we introduce an amplification factor to the step size in each iteration, and one pixel's overall gradient overflowing the $\epsilon$-constraint is properly assigned to its surrounding regions by a project kernel. But targeted attacks aim to push the adversarial examples into the territory of a specific class, and the amplification factor may lead to underfitting. Thus, we introduce the temperature and propose a patch-wise++ iterative method (PIM++) to further improve transferability without significantly sacrificing the performance of the white-box attack. Our method can be generally integrated to any gradient-based attack method. Compared with the current state-of-the-art attack methods, we significantly improve the success rate by 35.9\% for defense models and 32.7\% for normally trained models on average.
翻译:尽管在对深神经网络(DNN)的对抗性攻击方面取得了很大进展,但其可转移性仍然不尽如人意,特别是针对目标的攻击。背后有两个问题长期被忽视:(1) 传统设置的美元迭代,其职档大小为$\epsilon/T$,以遵守$\epsilon$-straint;在本案中,大多数像素允许添加非常小的噪音,大大低于$\epsilon美元;和(2) 通常操纵像素的噪音。然而,DNNS提取的像素特征受到其周围区域的影响,而不同的DNNNS通常被忽略了。 不同的DNS通常侧重于不同的歧视区域。为了解决这些问题,我们建议了一种不折合的迭代方法(PIM),目的是以高可转移性能为主。我们引入了一个振动的振动性系数,而一个以美元为主的加速度升升升度,一个像素-调的调度,通过一个不使用白心内尔格的项目模型将目前的攻击模式适当分配给其周围区域。但是,定型的比方方法通常旨在将我们平调的比方法的比方方法推动了我们的平方标准。