A Transferable Adversarial Belief Attack With Salient Region Perturbation Restriction

Deep neural networks are vulnerable to adversarial examples which are crafted by adding small perturbations on benign examples. However, most existing attack methods often perform a poor transferability to attack black-box models, especially to attack defense methods. In addition, perturbations added to semantically irrelevant regions of benign examples are usually inefficient for attacks. To address these issues, we propose a transferable adversarial belief attack with salient region perturbation restriction method, which improves transferability of adversarial examples and decreases the amount of perturbations significantly. Specifically, we first design a salient-region-based perturbation restriction strategy to restrict the range of perturbations into a salient region. After that, we present a transferable belief attack method to generate adversarial examples iteratively. Besides, our method can be easily integrated with other gradient-based transfer attack methods to further enhance the transferability of adversarial examples. Extensive experiments on the ImageNet dataset show that our method achieves higher transferability with lower perturbations than the state-of-the-art attack methods.