Boosting black-box targeted transferability from feature statistic perspective

Abstract

Adversarial examples are images that can be easily misclassified by deep learning models when small, imperceptible changes are added to them. They pose a security concern for the use of DNNs in practical applications because of their transferability. One mainstream method for black-box targeted attacks is feature space attacks. They mainly focus on iterative attacks and have generally attempted to modify the intermediate feature of source category similar to the feature of target category. In this paper, we explore that certain characteristics of features, such as feature style statistics, might be able to better represent the features themselves, and potentially lead to better transferability compared to simply aligning the source and the target features directly. Based on this, we propose a method which use the relationship between the style statistics of intermediate features and its corresponding category to boost black-box targeted transferability in generative attacks. We demonstrate the effectiveness of this method through experimental results.