AIIT: An adjustable integration adversarial attack based on image transformation.

Abstract

Deep neural networks (DNNs) are strongly vulnerable to adversarial attacks, which brings a large threat in safety-critical applications such as autonomous driving and facial recognition. The model integration technique, which adopts gradient information from many surrogate models, is commonly regarded as a powerful black-box attack method. But existing black-box attack methods using an integration model tend to average the outputs of several surrogate models. Such an approach ignores the gradient differences among these different models and the migrating characteristic of adversarial examples. In this way, the above method limits the diversity of adversarial examples, thus leads to low attack success rates across different models of different architectures. In order to solve these limitations, in this paper, we propose the hybrid method of model integration and input transformation, called AIIT. In AIIT, we consider image transform method to generate various adversarial examples and also consider dynamic gradient adjustment to promote model integration. Moreover, we present the gradient optimal algorithm to alleviate the overfitting of surrogate models.Extensive experiments on various datasets show that our approach can improve attack success rates by 13% to 35% compared to the existing methods and can achieve an average attack success rate of 90%, which proves effective in improving the transferability.