Abstract:As deep neural networks (DNNs) are widely applied in the physical world, many researches are focusing on physical-world adversarial examples (PAEs), which introduce perturbations to inputs and cause the model's incorrect outputs. However, existing PAEs face two challenges: unsatisfactory attack performance (i.e., poor transferability and insufficient robustness to environment conditions), and difficulty in balancing attack effectiveness with stealthiness, where better attack effectiveness often makes PAEs more perceptible. In this paper, we explore a novel perturbation-based method to overcome the challenges. For the first challenge, we introduce a strategy Deceptive RF injection based on robust features (RFs) that are predictive, robust to perturbations, and consistent across different models. Specifically, it improves the transferability and robustness of PAEs by covering RFs of other classes onto the predictive features in clean images. For the second challenge, we introduce another strategy Adversarial Semantic Pattern Minimization, which removes most perturbations and retains only essential adversarial patterns in AEsBased on the two strategies, we design our method Robust Feature Coverage Attack (RFCoA), comprising Robust Feature Disentanglement and Adversarial Feature Fusion. In the first stage, we extract target class RFs in feature space. In the second stage, we use attention-based feature fusion to overlay these RFs onto predictive features of clean images and remove unnecessary perturbations. Experiments show our method's superior transferability, robustness, and stealthiness compared to existing state-of-the-art methods. Additionally, our method's effectiveness can extend to Large Vision-Language Models (LVLMs), indicating its potential applicability to more complex tasks.

Guardian of the Ensembles: Introducing Pairwise Adversarially Robust Loss for Resisting Adversarial Attacks in DNN Ensembles

Attack As Defense: Characterizing Adversarial Examples Using Robustness.

Negatively correlated ensemble against transfer adversarial attacks

Improving Model Robustness Against Adversarial Examples with Redundant Fully Connected Layer.

Revisiting Ensembles in an Adversarial Context: Improving Natural Accuracy

Ensemble Methods as a Defense to Adversarial Perturbations Against Deep Neural Networks

Ensemble Adversarial Training: Attacks and Defenses

Certifying Joint Adversarial Robustness for Model Ensembles

Adversarial Robustness through Dynamic Ensemble Learning

Defense against Adversarial Attacks in NLP via Dirichlet Neighborhood Ensemble

Improving Adversarial Robustness via Promoting Ensemble Diversity.

Improving Adversarial Robustness via Attention and Adversarial Logit Pairing

An Ensemble Learning-Based Cooperative Defensive Architecture Against Adversarial Attacks

LEA2: A Lightweight Ensemble Adversarial Attack Via Non-overlapping Vulnerable Frequency Regions

Towards Robust Deep Learning with Ensemble Networks and Noisy Layers

REGroup: Rank-aggregating Ensemble of Generative Classifiers for Robust Predictions

Adversarial Vulnerability of Randomized Ensembles

Improving Adversarial Robustness Via Promoting Ensemble Diversity

Breaking Barriers in Physical-World Adversarial Examples: Improving Robustness and Transferability via Robust Feature

Provably Robust Adversarial Examples