What Do Visual Models Look At? Dilated Attention for Targeted Transferable Attacks

Abstract

Attention maps illustrate what visual models look at when processing benign images. However, when confronted with adversarial perturbations, attention undergoes significant alterations. Based on this phenomenon, previous non-targeted transferable attacks manipulate adversarial examples to generate distinct attention maps, disrupting crucial features shared among models. Nevertheless, the exploration of attention in targeted transferable attacks remains unexplored. To address this gap, we analyze alterations in attention across surrogate and black-box models, empirically observing that adversarial examples receiving more relevant features for the adversarial target label exhibit higher transferability across black-box models. Motivated by these findings, we propose the Dilated Attention (DA) attack, which integrates attention maximization loss and dynamic linear augmentation to improve targeted transferability. Attention maximization loss maximizes attention maps of the target label from multiple intermediate layers to attract greater attention. Dynamic linear augmentation leverages dynamic parameters to augment inputs with a broader range of attention maps, furnishing crafted perturbations with the robustness to dilate attention across diverse attention distributions. By considering the objective function and diverse inputs, DA generates adversarial examples with highly adversarial transferability against CNNs, ViTs, and adversarially trained models. We hope DA can serve as a foundational attack, guiding future research endeavors in the domain of targeted transferable attacks. The source code is available at: https://github.com/zhipeng-wei/DialtedAttention.