Enhancing Adversarial Example Transferability With an Intermediate Level Attack

By Qian Huang, Isay Katsman, Horace He, Zeqi Gu, Serge J. Belongie, Ser-Nam Lim. IEEE International Conference on Computer Vision, 2019

300 citations recorded by the source corpus.

Neural networks are vulnerable to adversarial examples, malicious inputs crafted to fool trained models. Adversarial examples often exhibit black-box transfer, meaning that adversarial examples for one model can fool another model. However, adversarial examples are typically overfit to exploit the particular architecture and feature representation of a source model, resulting in sub-optimal black-box transfer attacks to other target models. We introduce the Intermediate Level Attack (ILA), which attempts to fine-tune an existing adversarial example for greater black-box transferability by increasing its perturbation on a pre-specified layer of the source model, improving upon state-of-the-art methods. We show that we can select a layer of the source model to perturb without any knowledge of the target models while achieving high transferability. Additionally, we provide some explanatory insights regarding our method and the effect of optimizing for adversarial examples using intermediate feature maps.

Subfields: Artificial Intelligence, Computer Vision and Pattern Recognition, Emergency Medicine

View Paper: https://www.semanticscholar.org/paper/90dcaf5b7ded95f61666711aa94a59eae77bc304

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Vision and Pattern Recognition

Citations in the corpus

Skip Connections Matter: On the Transferability of Adversarial Examples Generated with ResNets (2020, background): “Intermediate Level Attack (Huang et al., 2019) attempts to ﬁne-tune an existing adversarial example for greater black-box transferability by increasing its perturbation on a pre-speciﬁed layer of the source model.”
Advances in adversarial attacks and defenses in computer vision: A survey (2021, methodology): “[104] fine-tuned adversarial examples using representations of pre-specified layers of the source model to improve attack transferability.”
On Improving Adversarial Transferability of Vision Transformers (2021, background): “Similarly, [34, 35, 36] also exploit intermediate layers to enhance transferability.”