Boosting targeted adversarial transferability via fine-grained feature mixup perturbation and reference-based...

Area of Science:

• Artificial Intelligence
• Computer Vision
• Machine Learning Security

Background:

• Deep neural networks are susceptible to adversarial examples, particularly in black-box settings.
• Targeted attacks pose significant threats by manipulating model predictions to specific classes.
• Existing feature mixup methods have limitations in spatial mixing and optimization strategies, hindering adversarial transferability.

Purpose of the Study:

• To address the limitations of existing feature mixup attacks.
• To propose a novel method, Fine-grained Feature Mixup Perturbation and Reference-based Gradient Refinement (FMGR), for enhancing adversarial transferability.
• To improve the effectiveness and efficiency of targeted adversarial attacks in black-box scenarios.

Main Methods:

• Fine-grained Feature Mixup Perturbation (FFM): Partitions feature maps into blocks and mixes them with spatially shuffled clean features.
• Reference-based Gradient Refinement (RGR): Selectively amplifies gradient deviations to escape local minima and improve transferability.
• Implementation and evaluation on ImageNet and CIFAR-10 datasets against CNN and Vision Transformer architectures.

Main Results:

• FMGR significantly enhances the transferability of adversarial examples.
• The proposed method outperforms state-of-the-art techniques in targeted black-box attacks.
• FMGR demonstrates effectiveness against both Convolutional Neural Networks (CNNs) and Vision Transformers.
• The approach maintains computational efficiency.

Conclusions:

• FMGR effectively overcomes the limitations of existing feature mixup attacks.
• The method provides a more generalizable approach to feature perturbation and optimization.
• FMGR represents a significant advancement in improving adversarial attack capabilities while maintaining efficiency.