Abstract:

Deep convolutional neural networks (DCNN) often exhibit insufficient robustness against carefully crafted adversarial examples. Existing gradient-based adversarial example generation methods frequently suffer from weak cross-model transferability due to overfitting to white-box models. To address this issue, this paper proposed a universal perturbations generation method based on high-level features and important channels to enhance the transferability of adversarial examples. The method incorporated three loss modules designed through deep mining of high-level features. First, the category gradient matrix of clean samples for specific classes was multiplied with the high-level feature maps of adversarial examples to construct the high-level feature important channel loss, which guided the perturbation direction in key regions of high-level features. Second, the similarity between global and local high-level feature matrices was calculated as the high-level feature similarity loss to control the perturbation guidance direction. Finally, the classification loss regulated the overall optimization direction during targeted attacks. The proposed method could be jointly trained with gradient update strategies such as DIM, TIM, and SIM during the gradient update process. Extensive experiments on ImageNet and Fashion MNIST datasets against various normally trained and adversarially trained DCNN models demonstrates that the adversarial examples generated by this method achieved significantly superior transferability attack performance compared to existing gradient-based adversarial example generation methods.

Key words: deep learning, adversarial examples, convolutional neural networks, high-level features, transferability