Deep neural networks (DNNs) have achieved remarkable success in computer vision yet remain vulnerable to adversarial examples. Existing attacks typically distribute perturbations uniformly across the input, without leveraging the model’s internal attention mechanism, and fail to adapt to model responses. To tackle these
[...] Read more.
Deep neural networks (DNNs) have achieved remarkable success in computer vision yet remain vulnerable to adversarial examples. Existing attacks typically distribute perturbations uniformly across the input, without leveraging the model’s internal attention mechanism, and fail to adapt to model responses. To tackle these limitations, we propose AG
2 (Attention-Guided Adversarial Sample Generation), an adversarial attack algorithm that uses dynamically updated attention maps to guide perturbation placement and a dynamic feedback mechanism for adaptive optimization. AG
2 comprises three steps: feature extraction and attention-weight computation, iterative optimization of perturbations guided by attention maps, and adjustment of optimization parameters based on attention shifts. By concentrating perturbations in regions receiving high attention from the victim model, AG
2 improves attack effectiveness while preserving visual imperceptibility. The dynamic feedback mechanism further maintains robustness against defended models such as those trained with defensive distillation. Experiments on MNIST, CIFAR-10, and ImageNet show that AG
2 achieves attack success rates of 93.7%, 93.5%, and 85.0%, respectively, outperforming prior methods. Moreover, AG
2 exhibits strong cross-architecture transferability, achieving a 69.5% success rate on Vision Transformers, which is higher than the previous method’s 55.3% by 14.2%. Theoretical analysis provides convergence guarantees and stability bounds for the proposed attention-guided optimization.
Full article