Rethinking Transferable Adversarial Attacks With Double Adversarial Neuron Attribution

Transferable adversarial attacks are a threat to deep neural networks, in particular, for black-box scenarios where access to model information is limited. One can, for example, exploit the intermediate layer neurons to generate transferable adversarial samples. However, current works show limitations in providing feature-level attack mechanisms across multiple victim models. In light of the attribution methods, in this article, we investigate the attribution similarity across different models. We leverage the similarity to incorporate different attribution properties to enhance the sample transferability, for the first time, formulating a novel neuron attribution-based transferable attack termed DANAA++. Specifically, we utilize a range of adversarial attack methods to generate different baseline points through adversarial training. The attribution results are thus obtained along both linear and nonlinear integration paths. In our experiments, the baseline points and integration paths significantly help improve the transferability of adversarial samples. Our approach provides novel insights for building effective attribution-based feature-level adversarial attacks. https://github.com/LMBTough/DANAAPP