Improving the Transferability of Adversarial Examples by Using Generative Adversarial Networks and Data Enhancement

Abstract

Deep neural networks (DNNs) can be attacked by adversarial examples that are undetectable by humans. Generation-based approaches have recently gained popularity because they directly translate the input distribution to the distribution of adversarial instances, making them more effective and efficient. However, existing techniques are susceptible to overfitting on the substitute model, limiting the transferability of adversarial examples. In this paper, we introduce data augmentation into AdvGAN, called AdvGAN-DE, which can dramatically improve the transferability of adversarial examples. Experiments demonstrate that we enhance the success rate by 31.09% for defense models and 10.23% for typically trained models on average when compared to AdvGAN.

Attacking Robot Vision Models Efficiently Based on Improved Fast Gradient Sign Method

“…The problem with this method is that the added perturbation cannot be constrained properly and may result in invalid adversarial examples [13]. The GAN-based methods [15,16] generate adversarial examples based on generative adversarial networks. These methods train (i) a feed-forward generator network that generates perturbations to create diverse adversarial examples and (ii) a discriminator network to ensure that the generated examples are realistic; once the generator network is trained, it can generate perturbations efficiently for any instance, so as to potentially accelerate adversarial training as defenses.…”