Enhancing Adversarial Example Transferability with an Intermediate Level Attack

TL;DR

The paper proposes the Intermediate Level Attack (ILA), a method to enhance the transferability of adversarial examples across models by fine-tuning perturbations at a specific layer, improving black-box attack success.

Contribution

Introducing ILA, a novel technique that increases adversarial transferability by targeting intermediate layers without needing target model information.

Findings

ILA improves transferability over state-of-the-art methods.

Layer selection can be done without target model knowledge.

Optimizing intermediate features enhances attack success.

Abstract

Neural networks are vulnerable to adversarial examples, malicious inputs crafted to fool trained models. Adversarial examples often exhibit black-box transfer, meaning that adversarial examples for one model can fool another model. However, adversarial examples are typically overfit to exploit the particular architecture and feature representation of a source model, resulting in sub-optimal black-box transfer attacks to other target models. We introduce the Intermediate Level Attack (ILA), which attempts to fine-tune an existing adversarial example for greater black-box transferability by increasing its perturbation on a pre-specified layer of the source model, improving upon state-of-the-art methods. We show that we can select a layer of the source model to perturb without any knowledge of the target models while achieving high transferability. Additionally, we provide some explanatory insights regarding our method and the effect of optimizing for adversarial examples using intermediate feature maps. Our code is available at https://github.com/CUVL/Intermediate-Level-Attack.