Abstract:Deep neural networks (DNNs) are shown to be vulnerable to universal adversarial perturbations (UAP), a single quasi-imperceptible perturbation that deceives the DNNs on most input images. The current UAP methods can be divided into data-dependent and data-independent methods. The former exhibits weak transferability in black-box models due to overly relying on model-specific features. The latter shows inferior attack performance in white-box models as it fails to exploit the model's response information to benign images. To address the above issues, this paper proposes a novel universal adversarial attack to generate UAP with strong transferability by disrupting the model-agnostic features (e.g., edges or simple texture), which are invariant to the models. Specifically, we first devise an objective function to weaken the significant channel-wise features and strengthen the less significant channel-wise features, which are partitioned by the designed strategy. Furthermore, the proposed objective function eliminates the dependency on labeled samples, allowing us to utilize out-of-distribution (OOD) data to train UAP. To enhance the attack performance with limited training samples, we exploit the average gradient of the mini-batch input to update the UAP iteratively, which encourages the UAP to capture the local information inside the mini-batch input. In addition, we introduce the momentum term to accumulate the gradient information at each iterative step for the purpose of perceiving the global information over the training set. Finally, extensive experimental results demonstrate that the proposed methods outperform the existing UAP approaches. Additionally, we exhaustively investigate the transferability of the UAP across models, datasets, and tasks.

UCG: A Universal Cross-Domain Generator for Transferable Adversarial Examples

CT-GAT: Cross-Task Generative Adversarial Attack Based on Transferability

Towards Transferable Unrestricted Adversarial Examples with Minimum Changes

Generating Universal Language Adversarial Examples by Understanding and Enhancing the Transferability Across Neural Models

Generating Transferable Adversarial Examples Against Vision Transformers

GCSA: A New Adversarial Example-Generating Scheme Towards Black-Box Adversarial Attacks

CDTA: A Cross-Domain Transfer-Based Attack with Contrastive Learning.

Generative Transferable Adversarial Attack

Improving Transferability of Adversarial Examples With Input Diversity

Improving Transferability of Universal Adversarial Perturbation with Feature Disruption.

Boosting Adversarial Transferability across Model Genus by Deformation-Constrained Warping

GM-Attack: Improving the Transferability of Adversarial Attacks

Improving the Transferability of Adversarial Examples with Diverse Gradients.

Boosting Transferability of Targeted Adversarial Examples via Hierarchical Generative Networks

Transferable Adversarial Attacks for Image and Video Object Detection

Delving into Transferable Adversarial Examples and Black-box Attacks

Common Knowledge Learning for Generating Transferable Adversarial Examples

Understanding and Enhancing the Transferability of Adversarial Examples

EGM: an Efficient Generative Model for Unrestricted Adversarial Examples

Enhancing Cross-task Transferability of Adversarial Examples Via Spatial and Channel Attention

Transfer Attacks Revisited: A Large-Scale Empirical Study in Real Computer Vision Settings