PaperlayerView exact revision on arXiv

Source-linked AI summary

Feature Importance-aware Transferable Adversarial Attacks

Zhibo Wang, Hengchang Guo, Zhifei Zhang, Wenxin Liu, Zhan Qin, Kui Ren

arXiv:2107.14185v3cs.CV

TL;DR

Existing transferable attacks indiscriminately distort features, risking model-specific local optima and limited transferability. FIA uses aggregate gradients to identify critical object-aware features and achieves superior transferability in experiments.

  • Problem

    Existing attacks indiscriminately distort features against a source model, which can trap adversarial examples in model-specific local optima and limit transferability.

  • Method

    FIA uses aggregate gradients across transformed inputs to estimate feature importance and guide perturbations toward critical object-aware features.

  • Results

    FIA demonstrates superior transferability compared with state-of-the-art transferable attacking methods across diverse classification models.

  • Takeaways & Limitations

    FIA provides a transferable-attack benchmark based on disrupting critical object-aware features across classification models.

  • Takeaways & Limitations

    Raw gradients and feature maps can remain visually noisy, with large gradients in non-object regions due to model-specific solution spaces.

Abstract

from arXiv · show

Transferability of adversarial examples is of central importance for attacking an unknown model, which facilitates adversarial attacks in more practical scenarios, e.g., black-box attacks. Existing transferable attacks tend to craft adversarial examples by indiscriminately distorting features to degrade prediction accuracy in a source model without aware of intrinsic features of objects in the images. We argue that such brute-force degradation would introduce model-specific local optimum into adversarial examples, thus limiting the transferability. By contrast, we propose the Feature Importance-aware Attack (FIA), which disrupts important object-aware features that dominate model decisions consistently. More specifically, we obtain feature importance by introducing the aggregate gradient, which averages the gradients with respect to feature maps of the source model, computed on a batch of random transforms of the original clean image. The gradients will be highly correlated to objects of interest, and such correlation presents invariance across different models. Besides, the random transforms will preserve intrinsic features of objects and suppress model-specific information. Finally, the feature importance guides to search for adversarial examples towards disrupting critical features, achieving stronger transferability. Extensive experimental evaluation demonstrates the effectiveness and superior performance of the proposed FIA, i.e., improving the success rate by 9.5% against normally trained models and 12.8% against defense models as compared to the state-of-the-art transferable attacks. Code is available at: https://github.com/hcguoO0/FIA

1. Introduction

Transfer-based attacks offer a practical black-box alternative, but conventional methods often overfit source-model features and transfer weakly. FIA instead targets critical object-aware features using aggregate gradients, and experiments report superior transferability.

  • Black-box motivation: Transfer-based attacks use adversarial examples crafted on one model to attack other models, avoiding excessive queries required by query-based attacks.This makes them more practical and flexible for black-box scenarios.
  • Research gap: Traditional attacks often transfer weakly because they overfit to the source model, motivating transformations and feature-level attack strategies.Existing methods add operations such as random transformation or attack intermediate representations to alleviate overfitting.
  • Proposed approach: FIA enhances transferability by disrupting critical object-aware features that dominate decisions across different models.The method is designed to avoid indiscriminate feature distortion and target features shared across models.
  • Proposed approach: Aggregate gradients guide FIA by suppressing model-specific information while providing object-aware feature importance for adversarial-example generation.The approach uses random transformations to help identify transferable feature importance.
  • Evaluation: Experiments on diverse classification models demonstrate superior transferability of FIA compared with state-of-the-art transferable attacks.The supplied introduction states the result broadly without reporting a numerical success-rate comparison.

2. Related Work

Related work improves adversarial-example transferability through stabilized optimization, input transformations, and internal feature distortion. FIA differs by weighting feature disruption according to importance rather than distorting features indiscriminately.

  • Transferability methods: Prior transferability methods stabilize iterative updates using momentum or Nesterov acceleration and modify inputs through random resizing and padding.These approaches aim to improve transferability during optimization.
  • Feature-level attacks: Feature-level attacks maximize internal representation distortion and have been reported to transfer across architectures, datasets, and tasks.These methods attack intermediate features instead of only disrupting the output layer.
  • FIA distinction: FIA extracts intermediate feature maps and uses gradients as feature importance to optimize weighted feature maps toward suppressing important features and promoting trivial ones.The overview describes the mechanism as producing higher-transferability adversarial examples.
  • FIA distinction: FIA belongs to the feature-level attack category but considers feature importance when disrupting critical object-aware features across models.Existing methods are characterized here as distorting features indiscriminately.

3. Preliminaries

The paper formulates adversarial-example generation as constrained perturbation of a clean image that causes a classifier to mispredict. Standard optimization requires source-model access, which is impractical for black-box attacks.

  • Adversarial-example formulation: Given a classifier fθ, the goal is to generate x_adv = x + ϵ such that fθ(x_adv) ≠ y while carefully designing perturbation ϵ.The perturbation is regularized with an ℓ_p norm.
  • Adversarial-example formulation: The loss function J measures distance between true and predicted labels, and this work uses p = ∞ for perturbation regularization.FGSM, BIM, and MIM are listed as methods for solving the resulting optimization problem.
  • Black-box constraint: Optimizing the standard formulation requires explicit access to the classifier parameters, making it impractical for black-box attacking.This motivates feasible alternatives based on transferability or other attack settings.

4. Feature Importance-aware Attack

FIA improves transferability by identifying model-agnostic, object-aware feature importance and directing adversarial optimization toward disrupting those critical features. It aggregates gradients from randomly transformed images to suppress model-specific information, then uses the resulting importance weights in the attack objective.

  • FIA guides transferable attacks by disrupting critical object-aware features that dominate decisions across models.
  • 4.1. Feature Importance by Aggregate Gradient: Raw feature gradients can contain model-specific information and visually noisy responses on non-object regions.
  • 4.1. Feature Importance by Aggregate Gradient: Aggregate gradients average gradients from randomly transformed or masked images, preserving robust object structure while neutralizing model-specific features.
  • 4.1. Feature Importance by Aggregate Gradient: The aggregate gradient highlights robust, critical object-aware regions and provides cleaner feature importance maps than raw gradients.
  • 4.2. Attack Algorithm: FIA minimizes a feature-weighted objective that decreases important features with positive weights and increases those with negative weights.
  • 4.3. Drawback of Related Attacks: Unlike NRDM’s indiscriminate feature distortion and FDA’s channel-mean criterion, FIA uses aggregate gradients to represent more intrinsic feature importance.

5. Experimental Evaluation

Experiments evaluate FIA on diverse classification models, parameter settings, feature layers, and aggregate-gradient objectives. FIA generally improves transferability, with aggregate-gradient guidance and tuned parameters supporting stronger attack success.

  • Experiment Setup: Experiments use 1,000 ImageNet-compatible images and twelve classification models, including normally trained and adversarially trained defense models.
  • Comparison of Transferability: FIA outperforms competing transferable attacks by 9.5% average success rate against normally trained models.Against normally trained models, FIA exceeds 90% success against each target when Vgg-16 is the source, while other methods can fall near 60%.
  • Comparison of Transferability: FIA and FIA+PITIDIM rank among the strongest methods against defense models, with the combination generally improving transferability over FIA alone.An ensemble containing Res-50, Res-152, Vgg-16, and Vgg-19 further improves all methods while FIA remains superior.
  • Effect of Parameters in Aggregate Gradient: Drop probability strongly affects success rate: optimal values are 0.2–0.3 for normally trained models and around 0.1 for defense models.Larger ensemble numbers generally increase success rate but gradually saturate; the selected ensemble number is N = 30.
  • Ablation Study: The aggregate-gradient objective L3 outperforms unconstrained feature distortion and raw-gradient objectives by a large margin in all cases.The layer choice also matters because early layers may be data-specific, whereas later layers can become model-specific.

6. Conclusion

The paper proposes FIA to generate highly transferable adversarial examples by using aggregate gradients to identify and disrupt critical object-aware features. Extensive experiments report superior performance over state-of-the-art methods, positioning FIA as a benchmark for model-robustness evaluation.

  • FIA uses aggregate gradients across classification models to guide adversarial optimization toward critical object-aware features that dominate model decisions.
  • Extensive experiments demonstrate FIA’s superior performance against state-of-the-art transferable attack methods.
  • FIA can serve as a benchmark for evaluating the robustness of various models.
Loading 2107.14185v3…