Deep neural networks are known to be extremely vulnerable to adversarial examples under white-box setting. Moreover, the malicious adversaries crafted on the surrogate (source) model often exhibit black-box transferability on other models with the same learning task but having different architectures. Recently, various methods are proposed to boost the adversarial transferability, among which the input transformation is one of the most effective approaches. We investigate in this direction and observe that existing transformations are all applied on a single image, which might limit the adversarial transferability. To this end, we propose a new input transformation based attack method called Admix that considers the input image and a set of images randomly sampled from other categories. Instead of directly calculating the gradient on the original input, Admix calculates the gradient on the input image admixed with a small portion of each add-in image while using the original label of the input to craft more transferable adversaries. Empirical evaluations on standard ImageNet dataset demonstrate that Admix could achieve significantly better transferability than existing input transformation methods under both single model setting and ensemble-model setting. By incorporating with existing input transformations, our method could further improve the transferability and outperforms the state-of-the-art combination of input transformations by a clear margin when attacking nine advanced defense models under ensemble-model setting. Code is available at https://github.com/JHL-HUST/Admix.
Transferable adversarial attack has drawn increasing attention due to their practical threaten to real-world applications. In particular, the feature-level adversarial attack is one recent branch that can enhance the transferability via disturbing the intermediate features. The existing methods usually create a guidance map for features, where the value indicates the importance of the corresponding feature element and then employs an iterative algorithm to disrupt the features accordingly. However, the guidance map is fixed in existing methods, which can not consistently reflect the behavior o…
Many adversarial attack methods achieve satisfactory attack success rates under the white-box setting, but they usually show poor transferability when attacking other DNN models. Momentum-based attack is one effective method to improve transferability. It integrates the momentum term into the iterative process, which can stabilize the update directions by adding the gradients' temporal correlation for each pixel. We argue that only this temporal momentum is not enough, the gradients from the spatial domain within an image, i.e. gradients from the context pixels centered on the target pixel are…
Enhancing Adversarial Transferability by Balancing Exploration and Exploitation with Gradient-Guided Sampling
School of Computer Science & Software Engineering, Shenzhen University, China（深圳大学计算机科学与软件工程学院）；Guangdong Laboratory of Artificial Intelligence and Digital Economy (SZ), Shenzhen, China（广东省人工智能与数字经济发展实验室（深圳））；Guangdong Provincial Key Laboratory of Intelligent Information Processing, Shenzhen University, China（广东省智能信息处理省级重点实验室）；School of Computer Science, University of Exeter, U.K.（埃克塞特大学计算机科学学院）；Department of Computing and Information Technology, Great Bay University, China（大鹏大学计算与信息技术系）；Computer Vision Institute, School of Artificial Intelligence, Shenzhen University, China（人工智能学院计算机视觉研究所）
Information-Geometric Inverse Distillation for Enhancing Adversarial Transferability
College of Computer Science, Sichuan University（四川大学计算机学院）；Sichuan Newstrong UHD Video Technology Company Ltd.（四川新创视超高清视频科技有限公司）；Institute of Optics and Electronics, Chinese Academy of Sciences（中国科学院光电技术研究所）
Looking From the Future: Multi-order Iterations Can Enhance Adversarial Attack Transferability
School of Cyber Science and Technology, Nanjing University of Science and Technology（南京理工大学网络空间科学与技术学院）；School of Computer Science and Technology, Nanjing University of Science and Technology（南京理工大学计算机科学与技术学院）；School of Computing, Faculty of Science and Engineering, Macquarie University（麦考瑞大学科学与工程学院计算学院）
本文提出 Looking From the Future 序列优化概念，并将其扩展为 LFF、MLFF 与多阶 $LLF^{\mathcal{N}}$ 攻击，以提升基于迭代的对抗攻击在 ImageNet1k 上的可迁移性。
Enhancing Diffusion-based Unrestricted Adversarial Attacks via Adversary Preferences Alignment
College of Intelligent Robotics and Advanced Manufacturing, Fudan University（智能机器人与先进制造学院，复旦大学）；Shanghai Key Lab of Intelligent Information Processing, College of Computer Science and Artificial Intelligence, Fudan University（上海智能信息处理重点实验室，计算机科学与人工智能学院，复旦大学）；Peking University（北京大学）；vivo Mobile Communication Co., Ltd（vivo移动通信有限公司）
Malicious attackers can generate targeted adversarial examples by imposing tiny noises, forcing neural networks to produce specific incorrect outputs. With cross-model transferability, network models remain vulnerable even in black-box settings. Recent studies have shown the effectiveness of ensemble-based methods in generating transferable adversarial examples. To further enhance transferability, model augmentation methods aim to produce more networks participating in the ensemble. However, existing model augmentation methods are only proven effective in untargeted attacks. In this work, we p…
Syracuse University（雪城大学）；University of Michigan（密歇根大学）；UCLA（加州大学洛杉矶分校）；Duke University（杜克大学）
Neural networks are known to be vulnerable to carefully crafted adversarial examples, and these malicious samples often transfer, i.e., they remain adversarial even against other models. Although great efforts have been delved into the transferability across models, surprisingly, less attention has been paid to the cross-task transferability, which represents the real-world cybercriminal's situation, where an ensemble of different defense/detection mechanisms need to be evaded all at once. In this paper, we investigate the transferability of adversarial examples across a wide range of real-wor…
Neural networks are vulnerable to adversarial examples, malicious inputs crafted to fool trained models. Adversarial examples often exhibit black-box transfer, meaning that adversarial examples for one model can fool another model. However, adversarial examples are typically overfit to exploit the particular architecture and feature representation of a source model, resulting in sub-optimal black-box transfer attacks to other target models. We introduce the Intermediate Level Attack (ILA), which attempts to fine-tune an existing adversarial example for greater black-box transferability by incr…
PLA Strategy Support Force Information Engineering University（解放军战略支援部队信息工程大学）
Deep neural networks have been shown to suffer from critical vulnerabilities under adversarial attacks. This phenomenon stimulated the creation of different attack and defense strategies similar to those adopted in cyberspace security. The dependence of such strategies on attack and defense mechanisms makes the associated algorithms on both sides appear as closely reciprocating processes. The defense strategies are particularly passive in these processes, and enhancing initiative of such strategies can be an effective way to get out of this arms race. Inspired by the dynamic defense approach i…
Improving Adversarial Transferability with Neighbourhood Gradient Information
Shanghai Key Lab of Intelligent Information Processing（上海智能信息处理关键实验室）；School of Computer Science, Fudan University（复旦大学计算机科学学院）；Shanghai Engineering Research Center of AI & Robotics（上海人工智能与机器人工程研究中心）；Academy for Engineering & Technology, Fudan University（复旦大学工程与技术学院）；Engineering Research Center of Robotics, Ministry of Education（教育部机器人工程研究中心）
DeepFake face swapping presents a significant threat to online security and social media, which can replace the source face in an arbitrary photo/video with the target face of an entirely different person. In order to prevent this fraud, some researchers have begun to study the adversarial methods against DeepFake or face manipulation. However, existing works focus on the white-box setting or the black-box setting driven by abundant queries, which severely limits the practical application of these methods. To tackle this problem, we introduce a practical adversarial attack that does not requir…
Strong Transferable Adversarial Attacks via Ensembled Asymptotically Normal Distribution Learning
School of Computer Science and Technology, Beijing Jiaotong University（北京交通大学计算机科学与技术学院）；Collaborative Innovation Center of Railway Traffic Safety（轨道交通安全协同创新中心）
National University of Defense Technology（国防科技大学）；National Innovation Institute of Defense Technology, Chinese Academy of Military Science（中国人民解放军军事科学院国防科技创新研究院）；Anhui University of Technology（安徽工业大学）
Deep learning methodology contributes a lot to the development of hyperspectral image (HSI) analysis community. However, it also makes HSI analysis systems vulnerable to adversarial attacks. To this end, we propose a masked spatial-spectral autoencoder (MSSA) in this paper under self-supervised learning theory, for enhancing the robustness of HSI analysis systems. First, a masked sequence attention learning module is conducted to promote the inherent robustness of HSI analysis systems along spectral channel. Then, we develop a graph convolutional network with learnable graph structure to estab…
Generating Transferrable Adversarial Examples via Local Mixing and Logits Optimization for Remote Sensing Object Recognition
State Key Laboratory of Spatial Datum, College of Remote Sensing and Geoinformatics Engineering, Henan University（空间基准国家重点实验室、遥感与地理信息工程学院、河南大学）；School of Computer and Information Engineering, Henan University（计算机与信息工程学院、河南大学）；School of Automation Science and Electrical Engineering, Beihang University（自动化科学与电气工程学院、北京航空航天大学）
Boosting Adversarial Transferability with Low-Cost Optimization via Maximin Expected Flatness
Key Laboratory of Aerospace Information Security and Trusted Computing, Ministry of Education, School of Cyber Science and Engineering, Wuhan University（航空信息安全与可信计算重点实验室、教育部、网络安全科学与工程学院、武汉大学）
MVPatch: More Vivid Patch for Adversarial Camouflaged Attacks on Object Detectors in the Physical World
School of Electronic and Information Engineering, Beihang University（北京航空航天大学电子信息工程学院）；Hefei Inovation Research Institute of Beihang University（北京航空航天大学合肥创新研究院）；School of Information Science and Engineering, Shandong University（山东大学信息科学与工程学院）；Shanghai Artificial Intelligence Laboratory（上海人工智能实验室）
Physically-Induced Atmospheric Adversarial Perturbations: Enhancing Transferability and Robustness in Remote Sensing Image Classification
School of Computer and Information Engineering, Xiamen University of Technology（厦门理工学院计算机与信息工程学院）；Faculty of Data Science, City University of Macau（澳门城市大学数据科学学院）；Dundee International Institute, Central South University（中南大学 Dundee 国际学院）；Department of Electrical and Computer Engineering, University of Hong Kong（香港大学电气与计算机工程系）；Department of Engineering, University of Cambridge（剑桥大学工程系）；School of Computer Science, Engineering Research Center of Machine Learning and Industry Intelligence, Sichuan University（四川大学计算机科学学院、机器学习与工业智能工程研究中心）；Hong Kong JC STEM Lab of Smart City and Department of Computer Science, City University of Hong Kong（香港城市大学智慧城市JC STEM实验室与计算机科学系）；Department of Computer and Information Science, Faculty of Science and Technology, University of Macau（澳门大学科学与技术学院计算机与信息科学系）
Beyond Deceptive Flatness: Dual-Order Solution for Strengthening Adversarial Transferability
School of Cyber Science and Engineering（网络安全科学与工程学院）；College of Electronics and Information Engineering（电子信息工程学院）；Company of Frost Drill Intellectual Software Pte. Ltd（冰钻智能软件私人有限公司）；School of Future Technology（未来技术学院）
SimMAT: Exploring Transferability from Vision Foundation Models to Any Image Modality
Center for Artificial Intelligence and Robotics, HKISI, CAS（中国科学院香港创新研究院人工智能与机器人中心）；Princeton University（普林斯顿大学）；The Hong Kong Polytechnic University（香港理工大学）；The Hong Kong University of Science and Technology（香港科技大学）；Nanyang Technological University（南洋理工大学）；State Key Laboratory of Multimodal Artificial Intelligence Systems, CASIA（中国科学院自动化研究所多模态人工智能系统国家重点实验室）
On the Transferability and Discriminability of Repersentation Learning in Unsupervised Domain Adaptation
National Key Laboratory of Space Integrated Information System, Institute of Software Chinese Academy of Sciences（空间信息集成信息系统国家重点实验室，软件研究所）；University of Chinese Academy of Sciences（中国科学院大学）；National Key Laboratory of Space Integrated Information System, Department of Computer Science and Technology, Tsinghua University（空间信息集成信息系统国家重点实验室，清华大学计算机科学与技术系）；Artificial Intelligence Thrust, Information Hub, Department of Computer Science & Engineering, School of Engineering, Hong Kong University of Science and Technology（人工智能 thrust，信息枢纽，工程学院计算机科学与工程系，香港科学与技术大学）
Prompt-driven Transferable Adversarial Attack on Person Re-Identification with Attribute-aware Textual Inversion
School of Artificial Intelligence and Robotics, Hunan University（湖南大学人工智能与机器人学院）；National Engineering Research Center of Robot Visual Perception and Control Technology（机器人视觉感知与控制技术国家工程研究中心）；College of Information Science and Engineering, Hunan Normal University（湖南师范大学信息科学与工程学院）
National University of Defense Technology（国防科技大学）；Defense Innovation Institute（国防创新研究院）；Chinese Academy of Military Science（中国人民解放军军事科学院）；Anhui University of Technology（安徽工业大学）
Transferable adversarial attack is always in the spotlight since deep learning models have been demonstrated to be vulnerable to adversarial samples. However, existing physical attack methods do not pay enough attention on transferability to unseen models, thus leading to the poor performance of black-box attack.In this paper, we put forward a novel method of generating physically realizable adversarial camouflage to achieve transferable attack against detection models. More specifically, we first introduce multi-scale attention maps based on detection models to capture features of objects wit…
Transferable Adversarial Facial Images for Privacy Protection
School of Software Engineering, Huazhong University of Science and Technology（华中科技大学软件学院）；School of Computer Science and Technology, Huazhong University of Science and Technology（华中科技大学计算机科学与技术学院）；School of Cyber Science and Engineering, Huazhong University of Science and Technology（华中科技大学网络空间安全学院）
