OADAS: Optimizing Global Perturbation Attacks with Dual-Path Attribution Synergy

Abstract

Deep Neural Networks (DNNs) are susceptible to adversarial example attacks, compromising the robustness of the models and potentially causing significant implications in highly secure domains. In recent studies, the attack success rate has always been an important metric, but for wider applications, imperceptible adversaries can be applied in privacy protection e.g. face recognition, so imperceptibility is also a significant metric. In adversarial attacks, global perturbation is a category of methods known for their high attack success rate, however, these methods can occasionally present challenges in preserving imperceptibility as they do not take into account the importance of each pixel point in their perturbation. To generate adversarial examples with high attack success rates while achieving better imperceptibility, this paper introduces a novel enhancer for global perturbation methods, named OADAS. We utilize the Control Region Path (CRP) to control the perturbation region, which governs subsequent perturbations on the target object for recognition to guarantee an attack success rate, meanwhile, the Illuminate Pixels Path (IPP) is used to limit the number of perturbed pixels points, thus ensuring stronger imperceptibility of the adversarial examples. We have extensively conducted experiments on the ImageNet-Compatible datasets to evaluate the selection of the attribution methods and imperceptibility. The results of these experiments demonstrate that our method achieves a significant improvement of approximately 1.5 times in imperceptibility compared to global perturbation methods, all while maintaining a high attack success rate.