Improving the Transferability of Adversarial Examples by Feature Augmentation.

Area of Science:

• Computer Vision
• Machine Learning Security

Background:

• Adversarial transferability enables adversarial examples to attack unknown models.
• Model architecture differences can weaken adversarial transferability.
• Existing methods like input transformation and ensemble attacks have limitations (ignoring model discrepancy, resource-intensive).

Purpose of the Study:

• To propose a simple and effective Feature Augmentation attack (FAUG) method to improve adversarial transferability.
• To dynamically add random noise to intermediate features during adversarial example generation to prevent overfitting.

Main Methods:

• Investigated model noise tolerance across different layers and noise strengths.
• Devised a dynamic random noise generation method based on mini-batch features.
• Applied a gradient-based attack algorithm on feature-augmented models.

Main Results:

• FAUG enhances adversarial transferability without extra computational cost.
• Achieved significant improvements: +30.67% on input transformation-based attacks and +5.57% on combination methods.
• Experiments on ImageNet across CNN and Transformer models validate the method's efficacy.

Conclusions:

• Feature Augmentation Attack (FAUG) is an effective technique for boosting adversarial transferability.
• The proposed dynamic noise injection method successfully mitigates overfitting to target models.
• FAUG offers a practical solution for creating more robust adversarial examples against diverse models.