Improving the Transferability of Adversarial Examples with Image Affine Transformation

Abstract

Deep learning is widely regarded as a black-box technology. We all know its performance is very good, but we have limited understanding of why it is so good. At present, there are many researches on the interpretability of deep neural network. By studying adversarial example, we can understand the internal semantics of neural network and find the decision boundary with problems, which in turn helps to improve the robustness and performance of neural network and its interpretability. With the development of adversarial example research, more and more adversarial example generation methods are proposed. Although the attack from adversarial example poses a great security threat to the deep learning system, it can also be used as an effective tool to measure the robustness and reliability of the model, and the attack and defense are two mutually promoting processes. Therefore, how to generate adversarial example with stronger attack ability is worth further study. And this study proposes a method named Affine-Invariant Method, aimed to improve the transferability of adversarial examples in black-box environment.

Enhancing the transferability of adversarial examples on vision transformers

“…23 The scale-invariant method (SIM) leverages the scale invariance of CNNs to optimize perturbations for a set of scaled images at each iteration. 24 Gradient optimization aims to stabilize the update direction of adversarial examples and escape from poor local optima. Dong et al 13 proposed the momentum iterative method (MIM) to stabilize the update direction and prevent local maxima by introducing a momentum term.…”

“…The Nesterov accelerated gradient can be viewed as another momentum term to improve transferability. 24 The skip gradient method (SGM) utilizes a decay factor to reduce the back-propagated gradient from the residual module to focus on more transferable low-level information. 25 The variance tuning method (VMI) adjusts the input gradient using the variance of gradient within the target image domain.…”

“…We first choose the classic gradient iteration-based method BIM 21 as our initial baseline. Additionally, we include two momentum-based iterative adversarial attacks, MIM 13 and NIM, 24 renowned for their superior transferability among white-box attack strategies. To benchmark our method against the most advanced approaches, we also compare it with PNA, 32 the current state-of-the-art attack method for ViTs.…”

“…Furthermore, to comprehensively assess our method's effectiveness, we combine it with various input transformations, including DIM, 14 TIM, 23 and SIM. 24…”

Research on License Plate Recognition Method Based on HALCON

“…Foreign research on license plate recognition relatively early and achieves good recognition results, the domestic research institutions also carried on the related research and discussion, the current mainstream of license plate recognition methods are: using the projection features of license plate recognition method, suitable for layout structured sample figure, but plate wear or tilt will has a great influence on the identification results, poor anti-interference ability [3]; Based on wavelet, this recognition method can extract Chinese character features of license plate directly from gray image without binarization, which avoids the loss of Chinese character structure information caused by binarization, but the recognition effect is not ideal when the character location is not accurate [4].…”