Learning Indistinguishable and Transferable Adversarial Examples

Abstract

The fast gradient sign method series can attack deep neural networks (DNNs) with high black-box success rates but with low image fidelity. Although the Adam iterative fast gradient tanh method breaks this limitation, its performance is not good enough. In this paper, we propose a Mixed-input Adam Iterative Fast Gradient Piecewise Linear Method (MAI-FGPLM) to generate adversarial examples with more indistinguishability and transferability for image classification task. Our method utilizes the piecewise linear function and the gradient regularization term to reduce the perturbation size for better image fidelity, and improves the transferability of adversarial examples via the mixed-input strategy for higher attack success rates. Extensive experiments on an ImageNet-compatible dataset show that the adversarial examples generated by our attack method have smaller perturbation size while offering higher attack success rates. Our best attack, NI-TI-DI-MAILM, evades six black-box defenses with the average perturbation size decreased by 1.11 and the average success rate increased by 2.1% compared with the state-of-the-art gradient-based attacks.