Abstract:Although there has been extensive research on the transferability of adversarial attacks, existing methods for generating adversarial examples suffer from two significant drawbacks: poor stealthiness and low attack efficacy under low-round attacks.To address the above issues, we creatively propose an adversarial example generation method that ensembles the class activation maps of multiple models, called class activation mapping ensemble attack.We first use the class activation mapping method to discover the relationship between the decision of the Deep Neural Network and the image region.Then we calculate the class activation score for each pixel and use it as the weight for perturbation to enhance the stealthiness of adversarial examples and improve attack performance under low attack rounds.In the optimization process, we also ensemble class activation maps of multiple models to ensure the transferability of the adversarial attack algorithm.Experimental results show that our method generates adversarial examples with high perceptibility, transferability, attack performance under low-round attacks, and evasiveness.Specifically, when our attack capability is comparable to the most potent attack (VMIFGSM), our perceptibility is close to the best-performing attack (TPGD).For non-targeted attacks, our method outperforms the VMIFGSM by an average of 11.69% in attack capability against 13 target models and outperforms the TPGD by an average of 37.15%.For targeted attacks, our method achieves the fastest convergence, the most potent attack efficacy, and significantly outperforms the eight baseline methods in lowround attacks.Furthermore, our method can evade defenses and be used to assess the robustness of models 1 .

GM-Attack: Improving the Transferability of Adversarial Attacks

SGMA: a Novel Adversarial Attack Approach with Improved Transferability

Admix: Enhancing the Transferability of Adversarial Attacks

Improving Adversarial Transferability with Neighbourhood Gradient Information

Improving Transferability of Adversarial Examples With Input Diversity

GCSA: A New Adversarial Example-Generating Scheme Towards Black-Box Adversarial Attacks

Boost Adversarial Transferability by Uniform Scale and Mix Mask Method

Transferable Adversarial Attacks for Image and Video Object Detection

Towards Transferable Unrestricted Adversarial Examples with Minimum Changes

Improving Adversarial Transferability with Heuristic Random Transformation.

Direction-Aggregated Attack for Transferable Adversarial Examples

Everywhere Attack: Attacking Locally and Globally to Boost Targeted Transferability

Boosting Transferability of Targeted Adversarial Examples via Hierarchical Generative Networks

Towards Transferable Targeted Attack.

Bag of Tricks to Boost Adversarial Transferability

Enhancing Adversarial Transferability with Local Transformation

Improving the Transferability of Adversarial Examples with Diverse Gradients.

Improving Adversarial Transferability with Gradient Refining

Attention Based Adversarial Attacks with Low Perturbations

Enhance Stealthiness and Transferability of Adversarial Attacks with Class Activation Mapping Ensemble Attack

AIM: Additional Image Guided Generation of Transferable Adversarial Attacks