<p>Existing transferable adversarial attacks process image pixels indiscriminately, leading to the overfitting of adversarial perturbations to model-specific background features and thus limited transferability. To address this issue, we propose an Importance-Aware Pixel-Level Masking (IPM) approach. By applying pixel-level random masks to non-critical regions with minimal impact on model decisions, IPM alleviates the overfitting of adversarial perturbations and guides perturbations to focus on disrupting decision-critical regions. Specifically, we first leverage a class activation mapping technique to locate important pixel regions. Then, we apply sparse random masks to the non-critical regions of the image before each iterative attack. Finally, we compute adversarial perturbations from the mask-preprocessed images and update the adversarial perturbations on the original unmasked images. Extensive experiments on the ImageNet dataset validate the superior effectiveness of the proposed method. Integrating IPM with existing approaches can significantly further boost the performance of state-of-the-art transferable attacks.</p>

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Enhancing adversarial transferability via importance-aware pixel-level mask

  • Yannan Jia,
  • Lize Gu,
  • Shihui Zheng

摘要

Existing transferable adversarial attacks process image pixels indiscriminately, leading to the overfitting of adversarial perturbations to model-specific background features and thus limited transferability. To address this issue, we propose an Importance-Aware Pixel-Level Masking (IPM) approach. By applying pixel-level random masks to non-critical regions with minimal impact on model decisions, IPM alleviates the overfitting of adversarial perturbations and guides perturbations to focus on disrupting decision-critical regions. Specifically, we first leverage a class activation mapping technique to locate important pixel regions. Then, we apply sparse random masks to the non-critical regions of the image before each iterative attack. Finally, we compute adversarial perturbations from the mask-preprocessed images and update the adversarial perturbations on the original unmasked images. Extensive experiments on the ImageNet dataset validate the superior effectiveness of the proposed method. Integrating IPM with existing approaches can significantly further boost the performance of state-of-the-art transferable attacks.