Revisiting Transferable Adversarial Images: Systemization, Evaluation, and New Insights.

Area of Science:

• Computer Vision
• Machine Learning Security
• Adversarial Machine Learning

Background:

• Transferable adversarial images pose significant security risks to computer vision systems in real-world black-box scenarios.
• Existing evaluations of transfer attacks lack systematic analysis and comprehensive assessment.

Purpose of the Study:

• To systematically categorize and comprehensively evaluate transfer attacks against various defenses.
• To identify and address limitations in current evaluation methodologies for attack transferability and stealthiness.

Main Methods:

• Systematized 23 representative transfer attacks into five categories within the machine learning pipeline.
• Evaluated attacks against 11 representative defenses, including recent transfer-oriented and real-world defenses like Google Cloud Vision.
• Analyzed attack transferability with fair hyperparameter settings and assessed stealthiness using diverse metrics and a user study.

Main Results:

• Identified critical issues in existing evaluations leading to misleading conclusions.
• Discovered that an early attack (DI) outperforms later ones, and state-of-the-art defenses (e.g., DiffPure) are vulnerable to black-box transfer attacks.
• Demonstrated significant variations in attack stealthiness under the same Lp constraint, based on diverse imperceptibility metrics and user perception.

Conclusions:

• Current evaluation practices for transferable adversarial images are flawed, necessitating revised methodologies.
• Addressing evaluation shortcomings reveals new insights into attack effectiveness and defense vulnerabilities.
• The study provides guidance for improved evaluation of adversarial images, advancing the design of more robust attacks and defenses.