Transferable adversarial attack based on attention space

Abstract

Adversarial attacks are a major challenge to the security of deep neural networks (DNNs). However, current transferable attacks often produce perturbations deterministically. This leads to poor local optima, resulting in low transferability. To address this issue, an attention-space transfer attack (ASTA) is proposed to enhance transferability through randomized disruption of salient features. Specifically, a randomized perturbation strategy utilizing latent codes is employed to disrupt shared attention features across models. Furthermore, attention and diversity loss functions are introduced to explicitly guide the generator in exploring the perturbation search space, thereby avoiding overfitting to surrogate models. Experimental results demonstrate that this method achieves an average attack success rate (ASR) of 83.6% on multiple black-box target ensemble models, 6.7% higher than the baseline methods. It effectively generates adversarial samples and demonstrates stronger transferability.

Keywords

transferable adversarial attacks / attention space / generative models / diversity regularization / image classification

References

[1] SZEGEDY C, VANHOUCKE V, IOFFE S, et al. Rethinking the inception architecture for computer vision. Proceedings of the 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR'16), 2016, Jun 27 - 30, Las Vegas, NV, USA. Piscataway, NJ, USA: IEEE, 2016: 2818-2826.

[2] GOODFELLOW I J, SHLENS J, SZEGEDY C . Explaining and harnessing adversarial examples. Proceedings of the 3rd International Conference on Learning Representations (ICLR'15), 2015, May 7 - 9, San Diego, CA, USA. 2015.

[3] ILYAS A, ENGSTROM L, ATHALYE A, et al. Black-box adversarial attacks with limited queries and information. Proceedings of the 35th International Conference on Machine Learning (PMLR'80), 2018, Jul 10 - 15, Stockholm, Sweden. 2018: 2137-2146.

[4] LÜ Z F, XIAO L, CHEN Y F, et al. Safe multi-agent reinforcement learning for wireless applications against adversarial communications. IEEE Transactions on Information Forensics and Security, 2024, 19: 6824-6839.

[5] KURAKIN A, GOODFELLOW I J, BENGIO S . Adversarial examples in the physical world. Proceedings of the 5th International Conference on Learning Representations (ICLR'17), 2017, Apr 24 - 26, Toulon, France. 2017: 14p

[6] DONG Y P, LIAO F Z, PANG T Y, et al. Boosting adversarial attacks with momentum. Proceedings of the 2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR'18), 2018, Jun 18 - 23, Salt Lake City, UT, USA. Piscataway, NJ, USA: IEEE, 2018: 9185-9193.

[7] XIE C, ZHANG Z S, ZHOU Y Y, et al. Improving transferability of adversarial examples with input diversity. Proceedings of the 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR'19), 2019, Jun 15 - 20, Long Beach, CA, USA. Piscataway, NJ, USA: IEEE, 2019: 2730-2739.

[8] DONG Y P, PANG T Y, SU H, et al. Evading defenses to transferable adversarial examples by translation-invariant attacks. Proceedings of the 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR'19), 2019, Jun 15 - 20, Long Beach, CA, USA. Piscataway, NJ, USA: IEEE, 2019: 4312-4321.

[9] WANG X S, HE K . Enhancing the transferability of adversarial attacks through variance tuning. Proceedings of the 2021 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR'21), 2021, Jun 20 - 25, Nashville, TN, USA. Piscataway, NJ, USA: IEEE, 2021: 1924-1933.

[10] ZHOU W, HOU X, CHEN Y J, et al. Transferable adversarial perturbations. Proceedings of the 15th European Conference on Computer Vision (ECCV'18), 2018, Sept 8 - 14, Munich, Germany. Berlin, Germany: Springer, 2018: 471-486.

[11] ILYAS A, SANTURKAR S, TSIPRAS D, et al. Adversarial examples are not bugs, they are features. Advances in Neural Information Processing Systems 32: Proceedings of the 33rd Conference on Neural Information Processing Systems (NeurIPS'19), 2019, Dec 8 - 14, Vancouver, Canada. 2019: 12p

[12] ZHANG W D, CHEN G C, ZHUANG P X, et al. CATNet: Cascaded attention transformer network for marine species image classification. Expert Systems with Applications, 2024, 256: Article 124932.

[13] WU W B, SU Y X, CHEN X X, et al. Boosting the transferability of adversarial samples via attention. Proceedings of the 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR'20), 2020, Jun 13 - 19, Seattle, WA, USA. Piscataway, NJ, USA: IEEE, 2020: 1161-1170.

[14] WANG Z B, GUO H C, ZHANG Z F, et al. Feature importance-aware transferable adversarial attacks. Proceedings of the 2021 IEEE/CVF International Conference on Computer Vision (ICCV'21), 2021, Oct 10 - 17, Montreal, Canada. Piscataway, NJ, USA: IEEE, 2021: 7639-7648.

[15] ZHANG J P, WU W B, HUANG J T, et al. Improving adversarial transferability via neuron attribution-based attacks. Proceedings of the 2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR'22), 2022, Jun 18 - 24, New Orleans, LA, USA. Piscataway, NJ, USA: IEEE, 2022: 14993-15002.

[16] ZHOU B L, KHOSLA A, LAPEDRIZA A, et al. Learning deep features for discriminative localization. Proceedings of the 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR'16), 2016, Jun 27 - 30, Las Vegas, NV, USA. Piscataway, NJ, USA: IEEE, 2016: 2921-2929.

[17] SELVARAJU R R, COGSWELL M, DAS A, et al. Grad-CAM: Visual explanations from deep networks via gradient-based localization. Proceedings of the 2017 IEEE/CVF International Conference on Computer Vision (ICCV'17), 2017, Oct 22 - 29, Venice, Italy. Piscataway, NJ, USA: IEEE, 2017: 618-626.

[18] DENG T, ZENG Z G . Generate adversarial examples by spatially perturbing on the meaningful area. Pattern Recognition Letters, 2019, 125: 632-638.

[19] ZHU H G, REN Y C, SUI X Y, et al. Boosting adversarial transferability via gradient relevance attack. Proceedings of the 2023 IEEE/CVF International Conference on Computer Vision (ICCV'23), 2023, Oct 1 - 6, Paris, France. Piscataway, NJ, USA: IEEE, 2023: 4741-4750.

[20] JANG Y, ZHAO T C, HONG S, et al. Adversarial defense via learning to generate diverse attacks. Proceedings of the 2019 IEEE/CVF International Conference on Computer Vision (ICCV'19), 2019, Oct 27 - Nov 2, Seoul, Republic of Korea. 2019: 2740-2749.

[21] DONG Y P, DENG Z J, PANG T Y, et al. Adversarial distributional training for robust deep learning. Advances in Neural Information Processing Systems 33: Proceedings of the 34th Conference on Neural Information Processing Systems (NeurIPS'20), 2020, Dec 6 - 12, Vancouver, Canada. 2020: 8270-8283.

[22] GAO L L, ZHANG Q L, SONG J K, et al. Patch-wise attack for fooling deep neural network. Proceedings of the 16th European Conference on Computer Vision (ECCV'20), 2020, Aug 23 - 28, Glasgow, UK. Berlin, Germany: Springer, 2020: 307-322.

[23] ZHANG J P, HUANG J T, WANG W X, et al. Improving the transferability of adversarial samples by path-augmented method. Proceedings of the 2023 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR'23), 2023, Jun 17 - 24, Vancouver, Canada. Piscataway, NJ, USA: IEEE, 2023: 8173-8182.

[24] CHEN J Q, CHEN H, CHEN K Y, et al. Diffusion models for imperceptible and transferable adversarial attack. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2025, 47(2): 961-977.

[25] GANESHAN A, BS V, BABU R V . FDA: Feature disruptive attack. Proceedings of the 2019 IEEE/CVF International Conference on Computer Vision (ICCV'19), 2019, Oct 27 - Nov 2, Seoul, Republic of Korea. 2019: 8069-8079.

[26] LIN C X, HU X J, ZHAN Y F, et al. MobileNetV2 with spatial attention module for traffic congestion recognition in surveillance images. Expert Systems with Applications, 2024, 255(D): Article 124701.

[27] YANG D D, HONG S H, JANG Y S, et al. Diversity-sensitive conditional generative adversarial networks. Proceedings of the 7th International Conference on Learning Representations (ICLR'19), 2019, May 6 - 9, New Orleans, LA, USA. 2019: DOI: 10.48550/arXiv.1901.09024.

[28] POURSAEED O, KATSMAN I, GAO B C, et al. Generative adversarial perturbations. Proceedings of the 2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR'18), 2018, Jun 18 - 23, Salt Lake City, UT, USA. Piscataway, NJ, USA: IEEE, 2018: 4422-4431.

[29] KINGMA D P, BA J L . ADAM: A method for stochastic optimization. Proceedings of the 3rd International Conference on Learning Representations (ICLR'15), 2015, May 7 - 9, San Diego, CA, USA. 2015: DOI: 10.48550/arXiv.1412.6980.

[30] RUSSAKOVSKY O, DENG J, SU H, et al. ImageNet large scale visual recognition challenge. International Journal of Computer Vision, 2015, 115(3): 211-252.

[31] KURAKIN A, GOODFELLOW I, BENGIO S, et al. Adversarial attacks and defences competition. The NIPS'17 Competition: Building Intelligent Systems. Berlin, Germany: Springer, 2018: 195-231.

[32] SZEGEDY C, IOFFE S, VANHOUCKE V, et al. Inception-v4, inception-resnet and the impact of residual connections on learning. Proceedings of the AAAI Conference on Artificial Intelligence, 2017, 31(1): 4278-4284.

[33] HE K M, ZHANG X Y, REN S Q, et al. Identity mappings in deep residual networks. Proceedings of the 14th European Conference on Computer Vision (ECCV'16), 2016, Oct 11 - 14, Amsterdam, The Netherlands. Berlin, Germany: Springer, 2016: 630-645.

[34] SIMONYAN K, ZISSERMAN A. Very deep convolutional networks for large-scale image recognition. Proceedings of the 3rd International Conference on Learning Representations (ICLR'15), 2015, May 7 - 9, San Diego, CA, USA. 2015: DOI: 10.48550/arXiv.1409.1556.

[35] ZHU R Y, ZHANG Z L, LIU Z, et al. Learning to transform dynamically for better adversarial transferability. Proceedings of the 2024 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR'24), 2024, Jun 16 - 22, Seattle, WA, USA. Piscataway, NJ, USA: IEEE, 2024: 24273-24283.

[36] SU D, ZHANG H, CHEN H G, et al. Is robustness the cost of accuracy: A comprehensive study on the robustness of 18 deep image classification models. Proceedings of the 15th European Conference on Computer Vision (ECCV'18), 2018, Sept 8 - 14, Munich, Germany. Berlin, Germany: Springer, 2018: 631-648.

[37] MADRY A, MAKELOV A, SCHMIDT L, et al. Towards deep learning models resistant to adversarial attacks. Proceedings of the 6th International Conference on Learning Representations (ICLR 2018), 2018, Apr 3 - May 3, Vancouver, Canada. 2018: 4138-4160.

[38] LI F F, FERGUS R, PERONA P . One-shot learning of object categories. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2006, 28(4): 594-611.