Pixel Importance-Based Transfer Adversarial Attack

It has been found that deep neural networks are prone to produce wrong classification results after adding small perturbations to input example, which is called adversarial attacks. Transfer attacks, as one of black-box attacks, it usually generates adversarial examples on white-box models and transfers the generated adversarial examples to black-box models. However, existing transfer-based adversarial attacks usually have high attack success rates (ASR) on white-box models, but relatively low ASR on black-box models. In addition, most of the existing transfer attacks actually perturb full pixels, resulting in a perturbation added to the redundant pixel. Therefore, in this work, a pixel importance-based transfer adversarial attack method (PI-TA) is designed, where the proposed method firstly obtains a pixel importance distribution matrix by calculating the importance of each pixel in terms of its impact on the image classification result. Secondly, a sparse perturbation matrix is obtained using a sparse perturbation strategy. Finally, a random perturbation is added to the pixels within the perturbation matrix on the original image to generate adversarial examples, and they are transferred to the black-box model for attack. The performance of PI-TA is verified by comparing it with some other state-of-the-art methods. The experimental results show that the proposed method improves the ASR of the adversarial examples on different models with only about 50% of the pixels perturbed.