Scholarlink

<p>In recent years, transfer-based adversarial attacks have received extensive research attention. However, existing methods often retain substantial model-specific features in adversarial samples due to overfitting the source model, resulting in low success rates for black-box attacks. In this work, we observe that applying multiple input transformations to samples reveals significant differences in the distribution of abnormally high-variance features across different models. We propose that suppressing these unstable features can reduce model-specific components in adversarial samples, thereby enhancing their transferability. To this end, we propose Feature Variance Suppression-based Adversarial Method (FVSM). This method suppresses high-variance features in the model’s feature layers, forcing perturbations to focus on stable response patterns across models. Specifically, we train an enhancer network that suppresses abnormally high variance features in specific layers of the source model. We then compute feature gradients using the enhanced images to obtain a more cross-model consistent gradient distribution. These purified gradients were subsequently utilized to guide adversarial sample generation. Experimental evaluations on ImageNet-compatible datasets demonstrate that FVSM effectively attacks diverse networks. Against normally trained models, FVSM achieves an average attack success rate of 89%−97%, representing up to an 8% improvement over existing state-of-the-art methods. Against adversarially trained defense models, FVSM achieves an average attack success rate of 66%−93%, with improvements reaching up to 5%.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

Feature variance suppression-based adversarial attack method

  • 期刊论文

  • 出版模式：

    开放获取

  • 发表日期：

    2026年4月21日

查看全文
  • Jiale Shi,
  • Yafei Song,
  • Weiliang Feng,
  • Cunqian Feng,
  • Haiyan Yang

摘要

In recent years, transfer-based adversarial attacks have received extensive research attention. However, existing methods often retain substantial model-specific features in adversarial samples due to overfitting the source model, resulting in low success rates for black-box attacks. In this work, we observe that applying multiple input transformations to samples reveals significant differences in the distribution of abnormally high-variance features across different models. We propose that suppressing these unstable features can reduce model-specific components in adversarial samples, thereby enhancing their transferability. To this end, we propose Feature Variance Suppression-based Adversarial Method (FVSM). This method suppresses high-variance features in the model’s feature layers, forcing perturbations to focus on stable response patterns across models. Specifically, we train an enhancer network that suppresses abnormally high variance features in specific layers of the source model. We then compute feature gradients using the enhanced images to obtain a more cross-model consistent gradient distribution. These purified gradients were subsequently utilized to guide adversarial sample generation. Experimental evaluations on ImageNet-compatible datasets demonstrate that FVSM effectively attacks diverse networks. Against normally trained models, FVSM achieves an average attack success rate of 89%−97%, representing up to an 8% improvement over existing state-of-the-art methods. Against adversarially trained defense models, FVSM achieves an average attack success rate of 66%−93%, with improvements reaching up to 5%.