MAP: Masked Adversarial Perturbation for Boosting Black-Box Attack Transferability

Area of Science:

• Artificial Intelligence
• Computer Vision
• Machine Learning Security

Background:

• Adversarial examples are crucial for black-box attacks, enabling model deception without internal access.
• Current methods struggle with transferability across different architectures like Convolutional Neural Networks (CNNs) and Vision Transformers (ViTs).
• Limited adversarial perturbation diversity causes surrogate model overfitting, hindering transferability.

Purpose of the Study:

• To propose a novel method, Masked Adversarial Perturbation (MAP), to enhance adversarial example transferability.
• To address the challenge of transferring attacks across diverse model architectures.
• To improve the effectiveness of black-box attacks by diversifying adversarial perturbations.

Main Methods:

• Introduced Masked Adversarial Perturbation (MAP) to diversify adversarial perturbations.
• MAP randomly masks perturbation patches during the generation process.
• This forces remaining patches to maintain attack efficacy, diversifying perturbations and mitigating surrogate model overfitting.

Main Results:

• MAP demonstrated superior transferability across various architectures compared to existing methods.
• The method effectively deceives both convolution and self-attention mechanisms.
• MAP consistently boosted diverse black-box attacks, achieving state-of-the-art performance.

Conclusions:

• Limited perturbation diversity is a key factor limiting adversarial transferability.
• MAP effectively diversifies perturbations, mitigating overfitting and enhancing cross-architecture transferability.
• The proposed method offers a significant advancement in black-box adversarial attacks.