Abstract:Transferability of adversarial examples is critical for black-box deep learning model attacks. While most existing studies focus on enhancing the transferability of untargeted adversarial attacks, few of them studied how to generate transferable targeted adversarial examples that can mislead models into predicting a specific class. Moreover, existing transferable targeted adversarial attacks usually fail to sufficiently characterize the target class distribution, thus suffering from limited transferability. In this paper, we propose the Transferable Targeted Adversarial Attack (TTAA), which can capture the distribution information of the target class from both label-wise and feature-wise perspectives, to generate highly transferable targeted adversarial examples. To this end, we design a generative adversarial training framework consisting of a generator to produce targeted adversarial examples, and feature-label dual discriminators to distinguish the generated adversarial examples from the target class images. Specifically, we design the label discriminator to guide the adversarial examples to learn label-related distribution information about the target class. Meanwhile, we design a feature discriminator, which extracts the feature-wise information with strong cross-model consistency, to enable the adversarial examples to learn the transferable distribution information. Furthermore, we introduce the random perturbation dropping to further enhance the transferability by augmenting the diversity of adversarial examples used in the training process. Experiments demonstrate that our method achieves excellent performance on the transferability of targeted adversarial examples. The targeted fooling rate reaches 95.13% when transferred from VGG-19 to DenseNet-121, which significantly outperforms the state-of-the-art methods.

Generate Transferable Adversarial Physical Camouflages via Triplet Attention Suppression

Dual Attention Suppression Attack: Generate Adversarial Camouflage in Physical World

Transferable Physical Attack against Object Detection with Separable Attention

Adversarial Camouflage: Hiding Physical-World Attacks with Natural Styles

Full-coverage Invisible Camouflage for Adversarial Targeted Attack

DTA: Physical Camouflage Attacks using Differentiable Transformation Network

Push & Pull: Transferable Adversarial Examples With Attentive Attack

Evading Defenses to Transferable Adversarial Examples by Mitigating Attention Shift

Towards Transferable Targeted 3D Adversarial Attack in the Physical World

Unified Adversarial Patch for Visible-Infrared Cross-modal Attacks in the Physical World

FCA: Learning a 3D Full-Coverage Vehicle Camouflage for Multi-View Physical Adversarial Attack

Towards Transferable Targeted Adversarial Examples

A Motional but Temporally Consistent Physical Video Examples

Multi-texture Fusion Attack: A Robust Adversarial Camouflage in Physical World

Universal Physical Camouflage Attacks on Object Detectors

CNCA: Toward Customizable and Natural Generation of Adversarial Camouflage for Vehicle Detectors

CamoEnv: Transferable and environment-consistent adversarial camouflage in autonomous driving

Learning Coated Adversarial Camouflages for Object Detectors

Meta-Attack - Class-agnostic and Model-agnostic Physical Adversarial Attack.

Unified Adversarial Patch for Cross-modal Attacks in the Physical World

Adaptive momentum variance for attention-guided sparse adversarial attacks