Abstract:The transferability and robustness of adversarial examples are two practical and important properties for black- box adversarial attacks. In this paper, we explore effective mechanisms to boost both of them across network hierarchy. In general, a typical network can be hierarchically divided into output stage, intermediate stage and input stage. Due to the over-specialization of the substitute model, we can hardly improve the transferability and robustness of the adversarial perturbations in the output stage. Therefore, we focus on manipulating the intermediate and input stages in this paper, and propose a Transferable and Robust Adversarial Perturbation generation (TRAP) method. Specifically, we propose the dynamically guided mechanism to continuously calculate accurate directional guidances for perturbation generation in the intermediate stage. In the input stage, instead of employing the single-form transformation augmentations adopted in the existing methods, we leverage multi-form affine transformation augmentations to enrich the input diversity and simultaneously boost the robustness and transferability of the adversarial perturbations. Extensive evaluations on ImageNet validation set demonstrate that our TRAP achieves superior transferability when attacking convolution neural networks (CNNs) and vision transformers (ViTs) compared to closely related state-of-the-art methods. For instance, based on the ResNet-101 model, we achieve an average attack success rate of 97.5% on black-box CNN models and 70.1% on ViT models, respectively. Moreover, TRAP exhibits robust performance against various physical-world interferences, such as Gaussian blurring, Gaussian noise, JPEG compression, color distortions, image erosion and image dilation. Additionally, we also show the potential application of our TRAP method for proactive defense against deepfake.

TransRPN: Towards the Transferable Adversarial Perturbations using Region Proposal Networks and Beyond

Robust Adversarial Perturbation on Deep Proposal-based Models

Exploring Transferable and Robust Adversarial Perturbation Generation Across Network Hierarchy

A Transferable Adversarial Attack Against Object Detection Networks

Towards cross-task universal perturbation against black-box object detectors in autonomous driving

Transferable Adversarial Attacks for Image and Video Object Detection

Region Feature Disentanglement for Domain Adaptive Object Detection

C-RPNs: Promoting object detection in real world via a cascade structure of Region Proposal Networks.

Transferable Adversarial Attacks for Object Detection Using Object-Aware Significant Feature Distortion

DeRPN: Taking a Further Step Toward More General Object Detection.

RPATTACK: Refined Patch Attack on General Object Detectors

Collaborative Training Between Region Proposal Localization and Classification for Domain Adaptive Object Detection

An Enhanced Region Proposal Network for Object Detection Using Deep Learning Method.

Improving Transferability of Adversarial Examples with Adversaries Competition

Domain-Invariant Region Proposal Network for Cross-Domain Detection

Adversarial patch attacks against aerial imagery object detectors

Playing Against Deep-Neural-Network-Based Object Detectors: A Novel Bidirectional Adversarial Attack Approach

Towards Transferable Adversarial Attacks with Centralized Perturbation

Universal adversarial perturbation for remote sensing images

Network transferability of adversarial patches in real-time object detection

TranSegPGD: Improving Transferability of Adversarial Examples on Semantic Segmentation