Feature Space Targeted Attacks by Statistic Alignment

TL;DR

This paper introduces novel feature space targeted attack methods using statistic alignment, which improve attack transferability and effectiveness by addressing limitations of pixel-wise discrepancy measures.

Contribution

It proposes two new attack approaches based on high-order statistic alignment, enhancing transferability and success rate over existing methods.

Findings

Outperforms state-of-the-art attack algorithms significantly.

Effective across various neural network layers and difficulty levels.

Code is publicly available for reproducibility.

Abstract

By adding human-imperceptible perturbations to images, DNNs can be easily fooled. As one of the mainstream methods, feature space targeted attacks perturb images by modulating their intermediate feature maps, for the discrepancy between the intermediate source and target features is minimized. However, the current choice of pixel-wise Euclidean Distance to measure the discrepancy is questionable because it unreasonably imposes a spatial-consistency constraint on the source and target features. Intuitively, an image can be categorized as "cat" no matter the cat is on the left or right of the image. To address this issue, we propose to measure this discrepancy using statistic alignment. Specifically, we design two novel approaches called Pair-wise Alignment Attack and Global-wise Alignment Attack, which attempt to measure similarities between feature maps by high-order statistics with translation invariance. Furthermore, we systematically analyze the layer-wise transferability with varied difficulties to obtain highly reliable attacks. Extensive experiments verify the effectiveness of our proposed method, and it outperforms the state-of-the-art algorithms by a large margin. Our code is publicly available at https://github.com/yaya-cheng/PAA-GAA.