Deep neural networks (DNNs) perform excellently in various vision tasks, however, they are susceptible to the adversarial samples. These samples are crafted by injecting subtle perturbations into benign images that are barely detectable to humans. Due to the differences between the substitute model and target model, the efficacy of black-box attack still yield suboptimal results. To address this issue, we propose a black-box attack approach, SD-FI2M, based on the momentum iterative fast gradient sign method, which can craft potent adversarial samples by inducing diverse inputs in the frequency domain and the saliency distribution of images. To enhance the diversity of input samples in frequency domain, a spectrum transformation technique utilizing the discrete cosine transform was used to craft adversarial samples with higher transferability. Further, Guided Grad-CAM was employed to obtain the saliency distribution of benign images, reducing indiscriminate damage to image features and alleviating the overfitting problem in adversarial samples. Extensive experiments on ImageNet have verified the superior attack performance and transferability of the proposed method.
Read full abstract