DEFEAT: Decoupled feature attack across deep neural networks.

Area of Science:

• Computer Science
• Artificial Intelligence
• Machine Learning Security

Background:

• Deep neural networks face security challenges from adversarial attacks.
• Existing feature-level attacks struggle against defenses due to domain overfitting.
• This degradation in performance gives a false sense of security against adversarial threats.

Purpose of the Study:

• To explain the domain-overfitting effect degrading feature-level attack transferability.
• To introduce a novel feature-level attack method, DEFEAT, to overcome defense mechanisms.
• To provide insights into the relationship between transferability and latent features in adversarial attacks.

Main Methods:

• DEFEAT decouples adversarial example generation from the optimization process.
• It learns a distribution of high-adversarial-effect perturbations in the first stage.
• Adversarial examples are assembled by iteratively sampling noises from the learned distribution.

Main Results:

• DEFEAT achieves an average success rate of 88.4% against defenses.
• The method significantly outperforms state-of-the-art transferable attacks by 11.5%.
• Experiments demonstrate DEFEAT's superiority on various black-box models.

Conclusions:

• DEFEAT effectively addresses the domain-overfitting problem in adversarial attacks.
• The proposed method enhances the success rate of feature-level attacks against defenses.
• DEFEAT offers a more robust approach to adversarial example generation and understanding attack mechanisms.