AdvWave: adversarial examples generation with wavelet feature fusion mechanisms
摘要
Though deep neural networks (DNNs) have demonstrated remarkable success in the community, it is very vulnerable to adversarial examples. Frequency domain transformation-based methods have been successfully utilized in adversarial attacks, such as AdvDrop. Nonetheless, AdvDrop cannot accurately drop the detail information of images due to the limitation of discrete cosine transform (DCT) to extract precise frequency information. In addition, adversarial examples generated by AdvDrop present noticeable blocking artifacts that considerably impair their quality caused by block-based image coding. Towards these ends, we propose a novel fusion-based frequency adversarial attack method named AdvWave, which generates adversarial examples using discrete wavelet transform (DWT) to extract more detailed frequency information from input images. AdvWave can effectively extract sub-band information which is discriminative for DNNs. Moreover, it adds elaborate perturbations to low-frequency information and drops the discriminative information in the process of quantization. By fusing the processed low-frequency and high-frequency information, the reconstructed images generated by AdvWave can easily fool the DNNs. Extensive experiments on several benchmark datasets demonstrate the effectiveness of AdvWave in improving the attack success rate and the quality of generated adversarial examples. The attack success rate of AdvWave on ImageNet surpasses the state-of-the-art method (AdvDrop) by an average of 1.5