SMGEA: A New Ensemble Adversarial Attack Powered by Long-Term Gradient Memories.

Area of Science:

• Computer Vision
• Machine Learning Security
• Deep Neural Networks

Background:

• Deep neural networks are susceptible to adversarial attacks, posing security risks to black-box applications.
• Existing transfer-based attacks have limited transferability due to small source model ensembles.
• Query-based black-box attacks incur high costs and risk detection.

Purpose of the Study:

• To propose a novel transfer-based black-box attack, Serial-Minigroup-Ensemble-Attack (SMGEA).
• To enhance the transferability and effectiveness of adversarial examples against target models.
• To reduce the query cost and detection risk associated with black-box attacks.

Main Methods:

• Dividing source models into minigroups with novel ensemble strategies for intragroup transferability.
• Employing a recursive algorithm to accumulate gradient memories across minigroups for intergroup transferability.
• Evaluating SMGEA on various datasets and real-world online saliency prediction systems.

Main Results:

• SMGEA achieves state-of-the-art black-box attack performance across multiple datasets.
• The attack successfully deceives two online saliency prediction systems: DeepGaze-II and SALICON.
• Demonstrated improved intragroup and intergroup transferability compared to existing methods.

Conclusions:

• SMGEA offers a potent and efficient method for crafting transferable adversarial examples in black-box settings.
• The proposed approach advances the security research of ubiquitous pixel-to-pixel computer vision tasks.
• A new code repository and model zoo are released to facilitate further research in adversarial attacks and defenses.