Improving the Transferability of Adversarial Examples With a Noise Data Enhancement Framework and Random Erasing - Xie, Pengfei; Shi, Shuhao; Yang, Shuai; Qiao, Kai; Liang, Ningning; Wang, Linyuan; Chen, Jian; Hu, Guoen; Yan, Bin (Frontiers in Neurorobotics, 2021)
Deep neural networks (DNNs) are proven vulnerable to attack against adversarial examples. Black-box transfer attacks pose a huge threat to AI applications without accessing target models. At present, the most effective black-box attack methods mainly adopt data enhancement methods such as input transformation. Previous data enhancement frameworks only work on input transformations that satisfy accuracy or loss invariance.However, it does not work for other transformations that do not meet the above conditions, such as the transformation of lost information. To solve this problem, we propose a new noise data enhancement framework (NDEF), which only transforms adversarial perturbation to effectively avoid the above problems. In addition, we introduce random erasing under this framework to prevent over-fitting of adversarial examples. Experimental results show that black-box attack success rate of our method REI-FGSM is 4.2% higher than DI-FGSM in six models on average and 6.6% higher than DI-FGSM in three defense models. REI-FGSM can combines with other methods to achieve greater performance. The attack performance of SI-FGSM can be improved by 22.9% on average when combined with REI-FGSM. Besides, our combined version with DI-TI-MI-FGSM, i.e., DI-TI-MI-REI-FGSM can achieve an average attack success rate of 97.0% against three ensemble adversarial training models, which is greater than current gradient iterative attack method. We also introduce Gaussian blur to prove the compatibility of our framework.