Direction-Aggregated Attack for Transferable Adversarial Examples
This addresses the problem of adversarial example transferability for security and robustness in deep learning, representing a strong specific gain rather than a foundational breakthrough.
The paper tackles the challenge of creating transferable adversarial examples that work across different models, especially in black-box settings, by proposing a Direction-Aggregated attack method. The result shows significant improvements, with attack success rates reaching 94.6% against adversarial trained models and 94.8% against defense methods on ImageNet.
Deep neural networks are vulnerable to adversarial examples that are crafted by imposing imperceptible changes to the inputs. However, these adversarial examples are most successful in white-box settings where the model and its parameters are available. Finding adversarial examples that are transferable to other models or developed in a black-box setting is significantly more difficult. In this paper, we propose the Direction-Aggregated adversarial attacks that deliver transferable adversarial examples. Our method utilizes aggregated direction during the attack process for avoiding the generated adversarial examples overfitting to the white-box model. Extensive experiments on ImageNet show that our proposed method improves the transferability of adversarial examples significantly and outperforms state-of-the-art attacks, especially against adversarial robust models. The best averaged attack success rates of our proposed method reaches 94.6\% against three adversarial trained models and 94.8\% against five defense methods. It also reveals that current defense approaches do not prevent transferable adversarial attacks.