{"type":"ScholarlyArticle","title":"Enhancing the Transferability of Adversarial Examples with Random Patch","authors":[{"name":"Yaoyuan Zhang","slug":"yaoyuan-zhang","given":"Yaoyuan","family":"Zhang","affiliation":"School of Computer Science and Technology , Beijing Institute of Technology"},{"name":"Yu-an Tan","slug":"yu-an-tan","given":"Yu-an","family":"Tan","affiliation":"School of Cyberspace Science and Technology , Beijing Institute of Technology {yaoyuan , tan2008 , chentian20 , 3220200923 ,"},{"name":"Tian Chen","slug":"tian-chen","given":"Tian","family":"Chen","affiliation":"School of Cyberspace Science and Technology , Beijing Institute of Technology {yaoyuan , tan2008 , chentian20 , 3220200923 ,"},{"name":"Xinrui Liu","slug":"xinrui-liu","given":"Xinrui","family":"Liu","affiliation":"School of Computer Science and Technology , Beijing Institute of Technology"},{"name":"Quanxin Zhang","slug":"quanxin-zhang","given":"Quanxin","family":"Zhang","affiliation":"School of Computer Science and Technology , Beijing Institute of Technology"},{"name":"Yuanzhang Li","slug":"yuanzhang-li","given":"Yuanzhang","family":"Li","affiliation":"School of Computer Science and Technology , Beijing Institute of Technology"}],"abstract":"Adversarial examples can fool deep learning models, and their transferability is critical for attacking black-box models in real-world scenarios. Existing state-of-the-art transferable adversarial attacks tend to exploit intrinsic features of objects to generate adversarial examples. This paper proposes the Random Patch Attack (RPA) to significantly improve the transferability of adversarial examples by the patch-wise random transformation that effectively highlights important intrinsic features of objects. Specifically, we introduce random patch transformations to original images to variate model-specific features. Important object-related features are preserved after aggregating the transformed images since they stay consistent in multiple transformations while model-specific elements are neutralized. The obtained essential features steer noises to perturb the object-related regions, generating the adversarial examples of superior transferability across different models. Extensive experimental results demonstrate the effectiveness of the proposed RPA. Compared to the state-of-the-art transferable attacks, our attacks improve the black-box attack success rate by 2.9\\% against normally trained models, 4.7\\% against defense models, and 4.6\\% against vision transformers on average, reaching a maximum of 99.1\\%, 93.2\\%, and 87.8\\%, respectively.","doi":"10.24963/ijcai.2022/233","url":"https://ijcai.org/proceedings/2022/233","pdf":"https://ijcai.org/proceedings/2022/0233.pdf","markdown":"https://ijcai.org/proceedings/2022/233.md","bibtex":"https://ijcai.org/proceedings/2022/bibtex/233","volume":{"slug":"2022","title":"Proceedings of the Thirty-First International Joint Conference on Artificial Intelligence","short_title":"IJCAI 2022","url":"https://ijcai.org/proceedings/2022/","year":2022,"location":"Vienna","dates":"23-29 July 2022","editors":"Luc De Raedt","isbn":"978-1-956792-00-3","publisher":"International Joint Conferences on Artificial Intelligence Organization","doi_prefix":"10.24963/ijcai.2022"},"section":"Computer Vision","track":"Main Track","number":233,"pages":{"first":1672,"last":1678},"keywords":["Computer Vision: Adversarial learning, adversarial attack and defense methods","Computer Vision: Recognition (object detection, categorization)"],"videos":[{"label":"Video #1","url":"https://slideslive.com/38986906","length_sec":87,"provider":"slideslive"},{"label":"Video #2","url":"https://slideslive.com/38985049","length_sec":340,"provider":"slideslive"}],"references":[{"position":1,"raw":"[Dong et al., 2018] Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boosting adversarial attacks with momentum. In IEEE Conference on Computer Vision and Pattern Recognition, pages 9185-9193, 2018.","title":"Boosting adversarial attacks with momentum","authors":"Dong","year":"2018","venue":"IEEE Conference on Computer Vision and Pattern Recognition","doi":null,"url":null,"internal_url":null},{"position":2,"raw":"[Dong et al., 2020] Yinpeng Dong, Tianyu Pang, Hang Su, and Jun Zhu. Evading defenses to transferable adversarial examples by translation-invariant attacks. In IEEE Confer- ence on Computer Vision and Pattern Recognition, 2020.","title":"Evading defenses to transferable adversarial examples by translation-invariant attacks","authors":"Dong","year":"2020","venue":"IEEE Conference on Computer Vision and Pattern Recognition","doi":null,"url":null,"internal_url":null},{"position":3,"raw":"[Ganeshan et al., 2019] Aditya Ganeshan, Vivek B.S., and R. Venkatesh Babu. Fda: feature disruptive attack. In IEEE International Conference on Computer Vision, 2019.","title":"Fda: feature disruptive attack","authors":"Aditya Ganeshan, B S Vivek, R Venkatesh, Babu","year":"2019","venue":"IEEE International Conference on Computer Vision","doi":null,"url":null,"internal_url":null},{"position":4,"raw":"[Gao et al., 2020] Lianli Gao, Qilong Zhang, Jingkuan Song, Xianglong Liu, and Heng Tao Shen. Patch-wise attack for fooling deep neural network. In European Conference on Computer Vision, pages 307-322, 2020.","title":"Patch-wise attack for fooling deep neural network","authors":"Gao","year":"2020","venue":"European Conference on Computer Vision","doi":null,"url":null,"internal_url":null},{"position":5,"raw":"[Goodfellow et al., 2015] Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In International Conference on Learning Representations, 2015.","title":"Explaining and harnessing adversarial examples","authors":"Ian J Goodfellow, Jonathon Shlens, Christian Szegedy","year":"2015","venue":"International Conference on Learning Representations","doi":null,"url":null,"internal_url":null},{"position":6,"raw":"[He et al., 2016] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Identity mappings in deep residual networks. In European Conference on Computer Vision, pages 630-645, 2016.","title":"Identity mappings in deep residual networks","authors":"Kaiming He, Xiangyu Zhang, Shaoqing Ren, Jian Sun","year":"2016","venue":"European Conference on Computer Vision","doi":null,"url":null,"internal_url":null},{"position":7,"raw":"[Heo et al., 2021] Byeongho Heo, Sangdoo Yun, Dongyoon Han, Sanghyuk Chun, Junsuk Choe, and Seong Joon Oh. Rethinking spatial dimensions of vision transformers. In International Conference on Computer Vision, 2021.","title":"Rethinking spatial dimensions of vision transformers","authors":"Heo","year":"2021","venue":"International Conference on Computer Vision","doi":null,"url":null,"internal_url":null},{"position":8,"raw":"[Huang et al., 2019] Qian Huang, Isay Katsman, Horace He, Zeqi Gu, Serge Belongie, and Ser-Nam Lim. Enhancing adversarial example transferability with an intermediate level attack. In IEEE International Conference on Com- puter Vision, 2019.","title":"Enhancing adversarial example transferability with an intermediate level attack","authors":"Qian Huang, Isay Katsman, Horace He, Zeqi Gu, Serge Belongie, Ser-Nam Lim","year":"2019","venue":"IEEE International Conference on Computer Vision","doi":null,"url":null,"internal_url":null},{"position":9,"raw":"[Ilyas et al., 2018] Andrew Ilyas, Logan Engstrom, Anish Athalye, and Jessy Lin. Black-box adversarial attacks with limited queries and information. In International Confer- ence on Machine Learning, pages 2137-2146, 2018.","title":"Black-box adversarial attacks with limited queries and information","authors":"Andrew Ilyas, Logan Engstrom, Anish Athalye, Jessy Lin","year":"2018","venue":"International Conference on Machine Learning","doi":null,"url":null,"internal_url":null},{"position":10,"raw":"[Ilyas et al., 2019] Andrew Ilyas, Shibani Santurkar, Logan Engstrom, Brandon Tran, and Aleksander Madry. Adver- sarial examples are not bugs, they are features. In An- nual Conference on Neural Information Processing Sys- tems, 2019.","title":"Adversarial examples are not bugs, they are features","authors":"Andrew Ilyas, Shibani Santurkar, Logan Engstrom, Brandon Tran, Aleksander Madry","year":"2019","venue":"Annual Conference on Neural Information Processing Systems","doi":null,"url":null,"internal_url":null},{"position":11,"raw":"[Kurakin et al., 2017a] Alexey Kurakin, Ian J Goodfellow, and Samy Bengio. Adversarial examples in the physical world. In International Conference on Learning Repre- sentations, 2017.","title":"Adversarial examples in the physical world","authors":"Kurakin","year":"2017","venue":"International Conference on Learning Representations","doi":null,"url":null,"internal_url":null},{"position":12,"raw":"[Kurakin et al., 2017b] Alexey Kurakin, Ian J Goodfellow, and Samy Bengio. Adversarial machine learning at scale. In International Conference on Learning Representations, 2017.","title":"Adversarial machine learning at scale","authors":"Kurakin","year":"2017","venue":"International Conference on Learning Representations","doi":null,"url":null,"internal_url":null},{"position":13,"raw":"[Liu et al., 2017] Yanpei Liu, Xinyun Chen, Chang Liu, and Dawn Song. Delving into transferable adversarial exam- ples and black-box attacks. In International Conference on Learning Representations, 2017.","title":"Delving into transferable adversarial examples and black-box attacks","authors":"Liu","year":"2017","venue":"International Conference on Learning Representations","doi":null,"url":null,"internal_url":null},{"position":14,"raw":"[Liu et al., 2021] Ze Liu, Yutong Lin, Yue Cao, Han Hu, Yixuan Wei, Zheng Zhang, Stephen Lin, and Baining Guo. Swin transformer: Hierarchical vision transformer using shifted windows. In International Conference on Com- puter Vision, 2021.","title":"Swin transformer: Hierarchical vision transformer using shifted windows","authors":"Ze Liu, Yutong Lin, Yue Cao, Han Hu, Yixuan Wei, Zheng Zhang, Stephen Lin, Baining Guo","year":"2021","venue":"International Conference on Computer Vision","doi":null,"url":null,"internal_url":null},{"position":15,"raw":"[Mahendran and Vedaldi, 2015] Aravindh Mahendran and Andrea Vedaldi. Understanding deep image representa- tions by inverting them. In IEEE Conference on Computer Vision and Pattern Recognition, pages 5188-5196, 2015.","title":"Understanding deep image representations by inverting them","authors":"Vedaldi Mahendran, Aravindh Mahendran, Andrea Vedaldi","year":"2015","venue":"IEEE Conference on Computer Vision and Pattern Recognition","doi":null,"url":null,"internal_url":null},{"position":16,"raw":"[Mahmood et al., 2021] Kaleel Mahmood, Rigel Mahmood, and Marten Van Dijk. On the robustness of vision trans- formers to adversarial examples. In IEEE International Conference on Computer Vision, 2021.","title":"On the robustness of vision transformers to adversarial examples","authors":"Kaleel Mahmood, Rigel Mahmood, Marten Van Dijk","year":"2021","venue":"IEEE International Conference on Computer Vision","doi":null,"url":null,"internal_url":null},{"position":17,"raw":"[Shi et al., 2019] Yucheng Shi, Siyu Wang, and Yahong Han. Curls & whey: Boosting black-box adversarial attacks. In IEEE Conference on Computer Vision and Pattern Recog- nition, pages 6519-6527, 2019.","title":"Curls & whey: Boosting black-box adversarial attacks","authors":"Yucheng Shi, Siyu Wang, Yahong Han","year":"2019","venue":"IEEE Conference on Computer Vision and Pattern Recognition","doi":null,"url":null,"internal_url":null},{"position":18,"raw":"[Simonyan and Zisserman, 2015] Karen Simonyan and An- drew Zisserman. Very deep convolutional networks for large-scale image recognition. In International Confer- ence on Learning Representations, 2015.","title":"Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition","authors":"Zisserman Simonyan","year":"2015","venue":"International Conference on Learning Representations","doi":null,"url":null,"internal_url":null},{"position":19,"raw":"[Szegedy et al., 2014] Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. In International Conference on Learning Representations, 2014.","title":"Intriguing properties of neural networks","authors":"Szegedy","year":"2014","venue":"International Conference on Learning Representations","doi":null,"url":null,"internal_url":null},{"position":20,"raw":"[Szegedy et al., 2016] Christian Szegedy, Vincent Van- houcke, Sergey Ioffe, Jon Shlens, and Zbigniew Wojna. Rethinking the inception architecture for computer vision. In IEEE Conference on Computer Vision and Pattern Recognition, pages 2818-2826, 2016.","title":"Rethinking the inception architecture for computer vision","authors":"Szegedy","year":"2016","venue":"IEEE Conference on Computer Vision and Pattern Recognition","doi":null,"url":null,"internal_url":null},{"position":21,"raw":"[Szegedy et al., 2017] Christian Szegedy, Sergey Ioffe, Vin- cent Vanhoucke, and Alexander A Alemi. Inception-v4, inception-resnet and the impact of residual connections on learning. In AAAI conference on artificial intelligence, 2017.","title":"Christian Szegedy, Sergey Ioffe, Vincent Vanhoucke, and Alexander A Alemi. Inception-v4, inception-resnet and the impact of residual connections on learning","authors":"Szegedy","year":"2017","venue":"AAAI conference on artificial intelligence","doi":null,"url":null,"internal_url":null},{"position":22,"raw":"[Touvron et al., 2021a] Hugo Touvron, Matthieu Cord, Matthijs Douze, Francisco Massa, Alexandre Sablay- rolles, and Hervé Jégou. Training data-efficient image transformers & distillation through attention. In Interna- tional Conference on Machine Learning, 2021.","title":"Training data-efficient image transformers & distillation through attention","authors":"Touvron","year":"2021","venue":"International Conference on Machine Learning","doi":null,"url":null,"internal_url":null},{"position":23,"raw":"[Touvron et al., 2021b] Hugo Touvron, Matthieu Cord, Alexandre Sablayrolles, Gabriel Synnaeve, and Hervé Jégou. Going deeper with image transformers. arXiv preprint arXiv:2103.17239, 2021.","title":"Going deeper with image transformers","authors":"Touvron","year":"2021","venue":null,"doi":null,"url":null,"internal_url":null},{"position":24,"raw":"[Tramèr et al., 2018] Florian Tramèr, Alexey Kurakin, Nico- las Papernot, Ian Goodfellow, Dan Boneh, and Patrick Mc- Daniel. Ensemble adversarial training: attacks and de- fenses. In International Conference on Learning Repre- sentations, 2018.","title":"Ensemble adversarial training: attacks and defenses","authors":"Florian Tramèr, Alexey Kurakin, Nicolas Papernot, Ian Goodfellow, Dan Boneh, Patrick Mc-Daniel","year":"2018","venue":"International Conference on Learning Representations","doi":null,"url":null,"internal_url":null},{"position":25,"raw":"[Wang et al., 2021a] Xiaosen Wang, Xuanran He, Jingdong Wang, and Kun He. Admix: Enhancing the transferability of adversarial attacks. In IEEE International Conference on Computer Vision, pages 16158-16167, 2021.","title":"Admix: Enhancing the transferability of adversarial attacks","authors":"Wang","year":"2021","venue":"IEEE International Conference on Computer Vision","doi":null,"url":null,"internal_url":null},{"position":26,"raw":"[Wang et al., 2021b] Zhibo Wang, Hengchang Guo, Zhifei Zhang, Wenxin Liu, Zhan Qin, and Kui Ren. Fea- ture importance-aware transferable adversarial attacks. In IEEE International Conference on Computer Vision, pages 7639-7648, 2021.","title":"Feature importance-aware transferable adversarial attacks","authors":"Wang","year":"2021","venue":"IEEE International Conference on Computer Vision","doi":null,"url":null,"internal_url":null},{"position":27,"raw":"[Wu et al., 2021] Weibin Wu, Yuxin Su, Michael R Lyu, and Irwin King. Improving the transferability of adversarial samples with adversarial transformations. In IEEE Confer- ence on Computer Vision and Pattern Recognition, pages 9024-9033, 2021.","title":"Improving the transferability of adversarial samples with adversarial transformations","authors":"Weibin Wu, Yuxin Su, Irwin Michael R Lyu, King","year":"2021","venue":"IEEE Conference on Computer Vision and Pattern Recognition","doi":null,"url":null,"internal_url":null},{"position":28,"raw":"[Xie et al., 2019] Cihang Xie, Zhishuai Zhang, Yuyin Zhou, Song Bai, Jianyu Wang, Zhou Ren, and Alan L Yuille. Im- proving transferability of adversarial examples with input diversity. In IEEE Conference on Computer Vision and Pattern Recognition, 2019.","title":"Improving transferability of adversarial examples with input diversity","authors":"Cihang Xie, Zhishuai Zhang, Yuyin Zhou, Song Bai, Jianyu Wang, Alan L Zhou Ren, Yuille","year":"2019","venue":"IEEE Conference on Computer Vision and Pattern Recognition","doi":null,"url":null,"internal_url":null},{"position":29,"raw":"[Zhou et al., 2018] Wen Zhou, Xin Hou, Yongjun Chen, Mengyun Tang, Xiangqi Huang, Xiang Gan, and Yong Yang. Transferable adversarial perturbations. In European Conference on Computer Vision, 2018.","title":"Transferable adversarial perturbations","authors":"Wen Zhou, Xin Hou, Yongjun Chen, Mengyun Tang, Xiangqi Huang, Xiang Gan, Yong Yang","year":"2018","venue":"European Conference on Computer Vision","doi":null,"url":null,"internal_url":null}],"license_note":"Copyright International Joint Conferences on Artificial Intelligence."}