Boosting Adversarial Transferability with Learnable Patch-wise Masks

TL;DR

This paper introduces a learnable patch-wise masking technique to improve the transferability of adversarial examples across models by removing model-specific regions, demonstrated to significantly boost attack success rates.

Contribution

It proposes a novel learnable patch-wise mask optimized via differential evolution to enhance adversarial transferability by reducing model-specific overfitting during attack generation.

Findings

Achieves an average success rate of 93.01% against seven defenses.

Effectively improves transferability when integrated with existing attack methods.

Demonstrates significant enhancement over state-of-the-art transfer-based attacks.

Abstract

Adversarial examples have attracted widespread attention in security-critical applications because of their transferability across different models. Although many methods have been proposed to boost adversarial transferability, a gap still exists between capabilities and practical demand. In this paper, we argue that the model-specific discriminative regions are a key factor causing overfitting to the source model, and thus reducing the transferability to the target model. For that, a patch-wise mask is utilized to prune the model-specific regions when calculating adversarial perturbations. To accurately localize these regions, we present a learnable approach to automatically optimize the mask. Specifically, we simulate the target models in our framework, and adjust the patch-wise mask according to the feedback of the simulated models. To improve the efficiency, the differential evolutionary (DE) algorithm is utilized to search for patch-wise masks for a specific image. During iterative attacks, the learned masks are applied to the image to drop out the patches related to model-specific regions, thus making the gradients more generic and improving the adversarial transferability. The proposed approach is a preprocessing method and can be integrated with existing methods to further boost the transferability. Extensive experiments on the ImageNet dataset demonstrate the effectiveness of our method. We incorporate the proposed approach with existing methods to perform ensemble attacks and achieve an average success rate of 93.01% against seven advanced defense methods, which can effectively enhance the state-of-the-art transfer-based attack performance.