Enhancing Cross-task Transferability of Adversarial Examples via Spatial and Channel Attention

Adversarial examples are well known to pose a security risk, when attacking deep learning models. While, most of existing adversarial attacks are designed to attack a single deep learning-based task, such as image classification. In practical scenarios, it is more necessary to study adversarial examples transferring across different vision tasks. However, it is challenging to create cross-task adversarial examples that can destroy multiple vision tasks at once due to unavailable various task-specific models and loss functions for attackers. To deal with this problem, we propose a Dual Attention-Guided Method (DAGM) for crafting cross-task adversarial examples by designing a spatial attention module and a channel attention module to capture overlapping discriminative regions and features that contribute to various tasks. Then we craft cross-task adversarial examples via reducing the dispersion (i.e., standard deviation) of feature maps re-weighted by both attention modules, which can destroy the overlapping discriminative regions and features for various tasks. Furthermore, to present theoretical explanation, we systematically analyze our method, and rigorously prove that both attention modules can provide better effectiveness of our adversarial examples, compared with existing cross-task adversarial attacks. Extensive experiments on two datasets demonstrate that our method can significantly degrade the performance of various tasks, even online CV APIs, and consistently outperform state-of-the-art methods by a large margin.