Enhancing adversarial transferability via importance-aware pixel-level mask
摘要
Existing transferable adversarial attacks process image pixels indiscriminately, leading to the overfitting of adversarial perturbations to model-specific background features and thus limited transferability. To address this issue, we propose an Importance-Aware Pixel-Level Masking (IPM) approach. By applying pixel-level random masks to non-critical regions with minimal impact on model decisions, IPM alleviates the overfitting of adversarial perturbations and guides perturbations to focus on disrupting decision-critical regions. Specifically, we first leverage a class activation mapping technique to locate important pixel regions. Then, we apply sparse random masks to the non-critical regions of the image before each iterative attack. Finally, we compute adversarial perturbations from the mask-preprocessed images and update the adversarial perturbations on the original unmasked images. Extensive experiments on the ImageNet dataset validate the superior effectiveness of the proposed method. Integrating IPM with existing approaches can significantly further boost the performance of state-of-the-art transferable attacks.