Extensive research has shown that adversarial samples crafted on surrogate models can effectively transfer to unknown black-box models, drawing significant attention to their cross-model transferability. Among various techniques, input transformation-based attack strategies have emerged as one of the most effective approaches to enhance such transferability. However, to increase the diversity of inputs, existing methods predominantly rely on mixing images across different categories, introducing semantic noise from unrelated classes. This external interference often leads to biased gradient estimation, which compromises both the stability and effectiveness of the attack. In this work, we observe that disturbing the internal structural relationships within an image can substantially alter its attention distribution, thereby simulating diverse representations of the same image. Based on this insight, we propose a novel input transformation method, called SelfMix-CF, which fuses a structurally perturbed version of an image with its original counterpart. This fusion increases the diversity of input samples without disrupting semantic consistency. Additionally, we design a central flip enhancer, a module that extends the coverage of target regions within the image. By exposing the model to structural variations from multiple directions and scales, this enhancer further increases the diversity and transferability of the generated perturbations. Extensive experiments on ImageNet compatible datasets demonstrate that SelfMix-CF significantly outperforms state-of-the-art input transformation-based attacks across various models, both with and without defense mechanisms, showcasing highly competitive transferability.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

SelfMix-CF: Self-mixing Transformation with Central-Flip Enhancement for Adversarial Transferability

  • Zewei Fu,
  • Ya Li

摘要

Extensive research has shown that adversarial samples crafted on surrogate models can effectively transfer to unknown black-box models, drawing significant attention to their cross-model transferability. Among various techniques, input transformation-based attack strategies have emerged as one of the most effective approaches to enhance such transferability. However, to increase the diversity of inputs, existing methods predominantly rely on mixing images across different categories, introducing semantic noise from unrelated classes. This external interference often leads to biased gradient estimation, which compromises both the stability and effectiveness of the attack. In this work, we observe that disturbing the internal structural relationships within an image can substantially alter its attention distribution, thereby simulating diverse representations of the same image. Based on this insight, we propose a novel input transformation method, called SelfMix-CF, which fuses a structurally perturbed version of an image with its original counterpart. This fusion increases the diversity of input samples without disrupting semantic consistency. Additionally, we design a central flip enhancer, a module that extends the coverage of target regions within the image. By exposing the model to structural variations from multiple directions and scales, this enhancer further increases the diversity and transferability of the generated perturbations. Extensive experiments on ImageNet compatible datasets demonstrate that SelfMix-CF significantly outperforms state-of-the-art input transformation-based attacks across various models, both with and without defense mechanisms, showcasing highly competitive transferability.