Scholarlink

<p>Attention maps illustrate what visual models look at when processing benign images. However, when confronted with adversarial perturbations, attention undergoes significant alterations. Based on this phenomenon, previous non-targeted transferable attacks manipulate adversarial examples to generate distinct attention maps, disrupting crucial features shared among models. Nevertheless, the exploration of attention in targeted transferable attacks remains unexplored. To address this gap, we analyze alterations in attention across surrogate and black-box models, empirically observing that adversarial examples receiving more relevant features for the adversarial target label exhibit higher transferability across black-box models. Motivated by these findings, we propose the Dilated Attention (DA) attack, which integrates attention maximization loss and dynamic linear augmentation to improve targeted transferability. Attention maximization loss maximizes attention maps of the target label from multiple intermediate layers to attract greater attention. Dynamic linear augmentation leverages dynamic parameters to augment inputs with a broader range of attention maps, furnishing crafted perturbations with the robustness to dilate attention across diverse attention distributions. By considering the objective function and diverse inputs, DA generates adversarial examples with highly adversarial transferability against CNNs, ViTs, and adversarially trained models. We hope DA can serve as a foundational attack, guiding future research endeavors in the domain of targeted transferable attacks. The source code is available at: <a href="https://github.com/zhipeng-wei/DialtedAttention">https://github.com/zhipeng-wei/DialtedAttention</a>.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

What Do Visual Models Look At? Dilated Attention for Targeted Transferable Attacks

  • 期刊论文

  • 发表日期：

    2025年8月27日

查看全文
  • Zhipeng Wei,
  • Jingjing Chen,
  • Yu-Gang Jiang

摘要

Attention maps illustrate what visual models look at when processing benign images. However, when confronted with adversarial perturbations, attention undergoes significant alterations. Based on this phenomenon, previous non-targeted transferable attacks manipulate adversarial examples to generate distinct attention maps, disrupting crucial features shared among models. Nevertheless, the exploration of attention in targeted transferable attacks remains unexplored. To address this gap, we analyze alterations in attention across surrogate and black-box models, empirically observing that adversarial examples receiving more relevant features for the adversarial target label exhibit higher transferability across black-box models. Motivated by these findings, we propose the Dilated Attention (DA) attack, which integrates attention maximization loss and dynamic linear augmentation to improve targeted transferability. Attention maximization loss maximizes attention maps of the target label from multiple intermediate layers to attract greater attention. Dynamic linear augmentation leverages dynamic parameters to augment inputs with a broader range of attention maps, furnishing crafted perturbations with the robustness to dilate attention across diverse attention distributions. By considering the objective function and diverse inputs, DA generates adversarial examples with highly adversarial transferability against CNNs, ViTs, and adversarially trained models. We hope DA can serve as a foundational attack, guiding future research endeavors in the domain of targeted transferable attacks. The source code is available at: https://github.com/zhipeng-wei/DialtedAttention.