Improving the Transferability of Adversarial Examples With a Noise Data Enhancement Framework and Random Erasing

Area of Science:

• Artificial Intelligence
• Machine Learning Security
• Deep Neural Networks

Background:

• Deep neural networks (DNNs) are vulnerable to adversarial examples, posing risks to AI applications.
• Black-box transfer attacks are a significant threat, especially when target models are inaccessible.
• Existing data enhancement methods for attacks often rely on accuracy or loss invariance, limiting their applicability.

Purpose of the Study:

• To propose a new noise data enhancement framework (NDEF) for black-box adversarial attacks.
• To address limitations of previous frameworks that fail with information-losing transformations.
• To enhance the effectiveness of adversarial attacks without requiring target model access.

Main Methods:

• Introduced a novel noise data enhancement framework (NDEF) focusing on adversarial perturbation.
• Integrated random erasing within the NDEF to mitigate adversarial example over-fitting.
• Developed and evaluated the Random Erasing Iterative Fast Gradient Sign Method (REI-FGSM).
• Demonstrated compatibility with other transformations like Gaussian blur.

Main Results:

• REI-FGSM achieved a 4.2% higher average black-box attack success rate than DI-FGSM across six models.
• REI-FGSM showed a 6.6% higher success rate than DI-FGSM against three defense models.
• Combining REI-FGSM with SI-FGSM improved attack performance by an average of 22.9%.
• A combined method, DI-TI-MI-REI-FGSM, achieved 97.0% average success rate against ensemble adversarial training models.

Conclusions:

• The proposed NDEF effectively enhances black-box adversarial attacks, overcoming limitations of prior methods.
• REI-FGSM demonstrates superior performance and compatibility with various transformations and attack strategies.
• The framework offers a promising direction for improving adversarial attack capabilities in black-box scenarios.