Abstract:Although there has been extensive research on the transferability of adversarial attacks, existing methods for generating adversarial examples suffer from two significant drawbacks: poor stealthiness and low attack efficacy under low-round attacks.To address the above issues, we creatively propose an adversarial example generation method that ensembles the class activation maps of multiple models, called class activation mapping ensemble attack.We first use the class activation mapping method to discover the relationship between the decision of the Deep Neural Network and the image region.Then we calculate the class activation score for each pixel and use it as the weight for perturbation to enhance the stealthiness of adversarial examples and improve attack performance under low attack rounds.In the optimization process, we also ensemble class activation maps of multiple models to ensure the transferability of the adversarial attack algorithm.Experimental results show that our method generates adversarial examples with high perceptibility, transferability, attack performance under low-round attacks, and evasiveness.Specifically, when our attack capability is comparable to the most potent attack (VMIFGSM), our perceptibility is close to the best-performing attack (TPGD).For non-targeted attacks, our method outperforms the VMIFGSM by an average of 11.69% in attack capability against 13 target models and outperforms the TPGD by an average of 37.15%.For targeted attacks, our method achieves the fastest convergence, the most potent attack efficacy, and significantly outperforms the eight baseline methods in lowround attacks.Furthermore, our method can evade defenses and be used to assess the robustness of models 1 .

Harmonizing Transferability and Imperceptibility: A Novel Ensemble Adversarial Attack

Enhance Stealthiness and Transferability of Adversarial Attacks with Class Activation Mapping Ensemble Attack

Diffusion Models for Imperceptible and Transferable Adversarial Attack

Understanding and Enhancing the Transferability of Adversarial Examples

Transferable Adversarial Examples Based on Global Smooth Perturbations

Transfer Attacks Revisited: A Large-Scale Empirical Study in Real Computer Vision Settings

An Optimized Transfer Attack Framework Towards Multi-Modal Machine Learning

Revisiting Transferable Adversarial Image Examples: Attack Categorization, Evaluation Guidelines, and New Insights

Towards Transferable Unrestricted Adversarial Examples with Minimum Changes

Improving Adversarial Transferability via Intermediate-level Perturbation Decay

Understanding Model Ensemble in Transferable Adversarial Attack

EnsembleFool: A Method to Generate Adversarial Examples Based on Model Fusion Strategy

Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attacks

Mutual-modality Adversarial Attack with Semantic Perturbation

Enhancing Adversarial Transferability with Adversarial Weight Tuning

Channel-augmented Joint Transformation for Transferable Adversarial Attacks

Frequency-driven Imperceptible Adversarial Attack on Semantic Similarity

Enhancing Adversarial Attacks: The Similar Target Method

An Adaptive Model Ensemble Adversarial Attack for Boosting Adversarial Transferability

Rethinking Model Ensemble in Transfer-based Adversarial Attacks

Generating Adversarial Examples with Controllable Non-transferability