Improving the Transferability of Adversarial Examples with Resized-Diverse-Inputs, Diversity-Ensemble and Region Fitting
arXiv:2112.06011 · doi:10.1007/978-3-030-58542-6_34
Abstract
We introduce a three stage pipeline: resized-diverse-inputs (RDIM), diversity-ensemble (DEM) and region fitting, that work together to generate transferable adversarial examples. We first explore the internal relationship between existing attacks, and propose RDIM that is capable of exploiting this relationship. Then we propose DEM, the multi-scale version of RDIM, to generate multi-scale gradients. After the first two steps we transform value fitting into region fitting across iterations. RDIM and region fitting do not require extra running time and these three steps can be well integrated into other attacks. Our best attack fools six black-box defenses with a 93% success rate on average, which is higher than the state-of-the-art gradient-based attacks. Besides, we rethink existing attacks rather than simply stacking new methods on the old ones to get better performance. It is expected that our findings will serve as the beginning of exploring the internal relationship between attack methods. Codes are available at https://github.com/278287847/DEM.
arXiv commentAccepted to ECCV2020
References in corpus (12)
- Explaining and Harnessing Adversarial Examples
- Intriguing properties of neural networks
- Evasion Attacks against Machine Learning at Test Time
- Delving into Transferable Adversarial Examples and Black-box Attacks
- Provable defenses against adversarial examples via the convex outer adversarial polytope
- Synthesizing Robust Adversarial Examples
- Certified Defenses against Adversarial Examples
- Countering Adversarial Images using Input Transformations
- Adversarial Machine Learning at Scale
- Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Models
- Simple Black-Box Adversarial Perturbations for Deep Networks
- Max-Mahalanobis Linear Discriminant Analysis Networks
Cited by in corpus (4)
- Adversarial Examples on Segmentation Models Can be Easy to Transfer
- Improving the Transferability of Adversarial Examples with New Iteration Framework and Input Dropout
- Exploring Transferable and Robust Adversarial Perturbation Generation from the Perspective of Network Hierarchy
- Meta Gradient Adversarial Attack