FDAA: A feature distribution-aware transferable adversarial attack method.

Area of Science:

• Artificial Intelligence
• Computer Vision
• Machine Learning

Background:

• Transferable adversarial attacks aim to fool unknown deep neural networks.
• Current methods struggle with feature map noise, information loss from augmentation, and feature distribution awareness.

Purpose of the Study:

• To propose a feature distribution-aware transferable adversarial attack (FDAA) method.
• To enhance the transferability of adversarial attacks against unknown deep neural networks.

Main Methods:

• Developed a novel Aggregated Feature Map Attack (AFMA) for feature map denoising.
• Introduced a Smixup input transformation strategy to preserve feature integrity.
• Implemented distinct strategies for different image regions based on feature distribution.

Main Results:

• The proposed FDAA method significantly improves attack transferability.
• Achieved an average success rate of 78.6% on adversarially trained models.
• Demonstrated effectiveness in denoising feature maps and capturing comprehensive features.

Conclusions:

• FDAA addresses limitations in existing transferable adversarial attacks.
• The method offers a more robust approach to generating adversarial examples for unknown models.
• Feature distribution awareness is crucial for enhancing adversarial attack transferability.