Attentional semantic attack for enhancing adversarial samples transferability.

Deep neural networks (DNNs) are highly susceptible to adversarial attacks, which can induce erroneous model outputs. While current adversarial attack methods demonstrate high efficacy in white-box settings, their performance often diminishes in black-box scenarios due to the limited transferability. Analysis of attention mechanisms across diverse DNNs reveals that, despite structural differences, models produce similar attentional semantic property for the same inputs and consequently make similar predictions. In this work, we innovatively propose attentional perturbation, which captures and modifies the similar attentional semantic property of the source and victim models to induce misclassification across multiple models. To efficiently use attentional perturbations, we propose an Attentional Semantic Attack method, called ASA. ASA employs attentional perturbation to degrade the attentional semantic property of original samples, optimizing a loss function to minimize the semantic property and thereby inducing model misclassification. The attentional perturbation is iteratively added to the original samples to generate adversarial samples with high transferability. Extensive experiments conducted on ImageNet demonstrate that ASA achieves better transferability than state-of-the-art adversarial attacks.