Boosting the Targeted Transferability of Adversarial Examples via Salient Region & Weighted Feature Drop

TL;DR

A novel framework based on Salient region&Weighted Feature Drop (SWFD) designed to enhance the targeted transferability of adversarial examples is introduced, which outperforms state-of-the-art methods across diverse configurations.

Abstract

Deep neural networks can be vulnerable to adversarially crafted examples, presenting significant risks to practical applications. A prevalent approach for adversarial attacks relies on the transferability of adversarial examples, which are generated from a substitute model and leveraged to attack unknown black-box models. Despite various proposals aimed at improving transferability, the success of these attacks in targeted black-box scenarios is often hindered by the tendency for adversarial examples to overfit to the surrogate models. In this paper, we introduce a novel framework based on Salient region & Weighted Feature Drop (SWFD) designed to enhance the targeted transferability of adversarial examples. Drawing from the observation that examples with higher transferability exhibit smoother distributions in the deep-layer outputs, we propose the weighted feature drop mechanism to modulate activation values according to weights scaled by norm distribution, effectively addressing the overfitting issue when generating adversarial examples. Additionally, by leveraging salient region within the image to construct auxiliary images, our method enables the adversarial example's features to be transferred to the target category in a model-agnostic manner, thereby enhancing the transferability. Comprehensive experiments confirm that our approach outperforms state-of-the-art methods across diverse configurations. On average, the proposed SWFD raises the attack success rate for normally trained models and robust models by 16.31% and 7.06% respectively.

Figures (5)

• Figure 1: Illustrating the average outputs of the Block-4 in RestNet18. (a) represents the weights of the last linear layer. (b-f) are outputs of clean images and adversarial examples generated by different algorithms. The outputs are plotted according to the indices of the sorted weights.
• Figure 2: The overview of SWFD framework, which mainly includes two stages: (1) Salient region generation. This stage generates salient regions based on the heatmap; (2) Perturbation optimization. This stage iteratively optimizes the perturbation through the joint classification loss of the original image and auxiliary image based on the weighted feature drop.
• Figure 3: (a) TASR (%) when attacking ResNet50 from DenseNet121. (b) The change in gradient norm as the number of iterations increases.
• Figure 4: Average TASR (%) when applying WFD at different layers with varying $p_w$ and $p_{rnd}$. Sequentially using DenseNet121, Inception-v3, ResNet50, and VGGNet16 as surrogate models. The target black-box models are the remaining three when one is used as the surrogate. The CE loss function is utilized.
• Figure 5: (a) Average TASR (%) under different parameters $(s_l, s_{int})$. (b) Average TASR (%) across different layers $l$ and parameters $\sigma$.