Introducing Competition to Boost the Transferability of Targeted Adversarial Examples through Clean Feature Mixup
This work addresses a specific bottleneck in adversarial machine learning for security researchers, offering an incremental improvement over prior methods.
The paper tackles the problem of low transferability in targeted adversarial examples by introducing competition during optimization, using a Clean Feature Mixup method that simulates interference from competitor noises, resulting in improved attack success rates that outperform existing baselines on ImageNet-Compatible and CIFAR-10 datasets.
Deep neural networks are widely known to be susceptible to adversarial examples, which can cause incorrect predictions through subtle input modifications. These adversarial examples tend to be transferable between models, but targeted attacks still have lower attack success rates due to significant variations in decision boundaries. To enhance the transferability of targeted adversarial examples, we propose introducing competition into the optimization process. Our idea is to craft adversarial perturbations in the presence of two new types of competitor noises: adversarial perturbations towards different target classes and friendly perturbations towards the correct class. With these competitors, even if an adversarial example deceives a network to extract specific features leading to the target class, this disturbance can be suppressed by other competitors. Therefore, within this competition, adversarial examples should take different attack strategies by leveraging more diverse features to overwhelm their interference, leading to improving their transferability to different models. Considering the computational complexity, we efficiently simulate various interference from these two types of competitors in feature space by randomly mixing up stored clean features in the model inference and named this method Clean Feature Mixup (CFM). Our extensive experimental results on the ImageNet-Compatible and CIFAR-10 datasets show that the proposed method outperforms the existing baselines with a clear margin. Our code is available at https://github.com/dreamflake/CFM.