Transferable adversarial attack has drawn increasing attention due to their practical threaten to real-world applications. In particular, the feature-level adversarial attack is one recent branch that can enhance the transferability via disturbing the intermediate features. The existing methods usually create a guidance map for features, where the value indicates the importance of the corresponding feature element and then employs an iterative algorithm to disrupt the features accordingly. However, the guidance map is fixed in existing methods, which can not consistently reflect the behavior of networks as the image is changed during iteration. In this paper, we describe a new method called Feature-Momentum Adversarial Attack (FMAA) to further improve transferability. The key idea of our method is that we estimate a guidance map dynamically at each iteration using momentum to effectively disturb the category-relevant features. Extensive experiments demonstrate that our method significantly outperforms other state-of-the-art methods by a large margin on different target models.
翻译:可转移的对抗性攻击因其对现实世界应用的实际威胁而引起越来越多的注意,特别是地平级对抗性攻击是最近的一个分支,可以通过干扰中间特征来提高可转移性。现有方法通常会为特征绘制一个指导地图,其价值表明相应的特征要素的重要性,然后采用迭代算法来破坏这些特征。然而,指导地图是在现有方法中固定的,无法始终反映网络行为,因为图像在迭代期间发生变化。本文描述了一种新方法,称为“地貌-运动反向攻击”(FMAA),以进一步改进可转移性。我们方法的关键思想是,我们利用有效扰动与类别有关的特征的动力,对每种迭代方向图进行动态估计。广泛的实验表明,我们的方法大大超越了不同目标模型上的其他最先进的方法。