Adversarial attacks with improved transferability - the ability of an adversarial example crafted on a known model to also fool unknown models - have recently received much attention due to their practicality. Nevertheless, existing transferable attacks craft perturbations in a deterministic manner and often fail to fully explore the loss surface, thus falling into a poor local optimum and suffering from low transferability. To solve this problem, we propose Attentive-Diversity Attack (ADA), which disrupts diverse salient features in a stochastic manner to improve transferability. Primarily, we perturb the image attention to disrupt universal features shared by different models. Then, to effectively avoid poor local optima, we disrupt these features in a stochastic manner and explore the search space of transferable perturbations more exhaustively. More specifically, we use a generator to produce adversarial perturbations that each disturbs features in different ways depending on an input latent code. Extensive experimental evaluations demonstrate the effectiveness of our method, outperforming the transferability of state-of-the-art methods. Codes are available at https://github.com/wkim97/ADA.
翻译:以已知模式制作的对抗性攻击提高了可转移性 -- -- 以已知模式为借口的对抗性例子的能力,也愚弄了未知模式 -- -- 最近由于其实用性而引起人们的极大关注,然而,现有的可转移攻击性攻击以决定性的方式发生,往往未能充分探索损失表面,从而落到当地最差的地方,受低可转移性的影响。为解决这一问题,我们提议采用 " 惯性-多样性攻击(ADA) " (ADA),这种攻击以分辨方式破坏各种显著特征,提高可转移性。我们主要干扰破坏对破坏不同模式所共有的普遍特征的图像关注。然后,为了有效地避免当地可选择性差,我们以随机化的方式破坏这些特征,并更详尽地探索可转移扰动性扰动性的搜索空间。更具体地说,我们使用一台发电机产生对抗性扰动性扰动性扰动性扰动性,每个特征都取决于投入潜值的代码。广泛的实验性评估表明我们的方法的有效性,超过了状态-艺术方法的可转移性。在http://github.com/wki97/ADADADADADADADADA中可以使用代码。