An Attention-Guided Dynamic Stride Projection Attack Framework

Abstract

Black-box transfer attacks represent a critical paradigm in adversarial machine learning, whereby adversarial examples crafted against a surrogate (source) model are deployed to deceive unknown target models. This approach serves as a vital tool for conducting security audits and enhancing the robustness of deep neural networks. A primary challenge, however, lies in the tendency of iterative attack methods to overfit the specific characteristics of the source model, thereby diminishing their cross-model transferability. To mitigate this issue, this paper proposes a novel Dynamic Step-length Projection Attack method based on Attention Guidance (DSP-Attack). The core of our method is twofold. First, it introduces a dynamic mechanism that adaptively adjusts the projection step size during the iterative perturbation generation process. This is motivated by the observation that initial perturbations often possess higher transferability; the proposed strategy thus prioritizes these early stages by employing a larger effective step size, while strategically curtailing potentially overfitting and ineffective perturbations in later iterations. Second, the method incorporates an attention guidance mechanism, derived from the source model's gradient-weighted class activation mapping, to focus the perturbation budget on regions that the model deems most salient for its predictions. This ensures that the adversarial modifications are applied to semantically meaningful and model-sensitive areas, thereby increasing the likelihood of the attack transferring to other architectures. Comprehensive experiments on the ImageNet dataset demonstrate the superior efficacy of our approach. The proposed DSP-Attack achieves significant performance improvements in transferability across a diverse set of target models, including ResNet, VGG, and DenseNet architectures, outperforming several state-of-the-art baseline methods. These findings affirm that jointly optimizing the attack trajectory via dynamic step-length control and spatial attention guidance is a potent strategy for crafting highly transferable adversarial examples.