Improving the transferability of adversarial examples via the high-level interpretable features for object detection
摘要
Progress in deep learning technology has positioned object detection models as crucial tools for solving complex computer vision problems, particularly in fields such as autonomous driving, intelligent surveillance, and medical diagnosis. However, the vulnerability of these models to adversarial attacks presents significant risks to their safety in application. In particular, during real-world deployment, models often function as black boxes, and transferable adversarial attacks have drawn increasing attention due to their tangible threats to practical applications. Among these, feature-level adversarial attacks have emerged as a new branch in this field, enhancing the transferability of adversarial examples by interfering with the model's intermediate features. To address the issue of gradient saturation during backpropagation in existing methods, this study proposes a High-level Interpretable Features Attack method. This method, through Diversity-Enhanced Integrated Gradients, assesses the key features that different models rely on in common, providing more reliable guidance for generating adversarial examples. Additionally, we introduce random transformations such as motion blur and salt-and-pepper noise, which not only enrich the diversity of input samples but also strengthen integral gradient features that are generally effective across different models, thereby reducing the dependency of adversarial examples on specific model architectures. Through a series of extensive experiments, we demonstrate that the proposed method can effectively attack various object detection models, including Faster R-CNN, SSD, RetinaNet, YOLOv5, and YOLOv8, significantly enhancing the cross-model transferability of adversarial examples. Our method achieves an attack success rate of up to 90% on the YOLOv8 model. These results not only underscore the effectiveness of the attack strategy but also highlight its universality and practicality in real-world applications.