Unrestricted adversarial attacks aim to fool DNNs by generating effective yet photorealistic examples. However, previous methods usually rely on global perturbations to enhance attack performance, which inevitably introduces visual distortions. To reduce visual distortions in the background, we propose a diffusion-based framework that focuses on local perturbations to generate object-level unrestricted adversarial examples (ObjectAdv). Since the cross-attention maps of Stable Diffusion contain the object information, we directly leverage the attention maps to localize the semantic region of object where for attacking. Second, a prompt-switching strategy is proposed for both imperceptibility and attack capacity. Specifically, to preserve layout and object shape of clean image, a prompt of true category is used at early denoising steps. At the later steps, we propose a well-designed prompt to guide the diffusion model to generate transferable adversarial examples. This local attack may cause inconsistency between the perturbed object and the background in adversarial examples. An FFT-based edge smoother is utilized to ensure seamless blending of the edges. ObjectAdv achieves an average ASR of 99.2% in white-box test on the ImageNet-compatible dataset, and outperforms existing methods on defense performance (+5%) and image quality metrics, e.g., SSIM of 0.9140 (+0.1048) and FID of 25.63 (-19.27).

Adversarial examples’ (AE) transferability refers to the phenomenon that AEs crafted with one surrogate model can also fool other models. Notwithstanding remarkable progress in untargeted transferability, its targeted counterpart remains challenging. This paper proposes an everywhere scheme to boost targeted transferability. Our idea is to attack a victim image both globally and locally. We aim to optimize ‘an army of targets’ in every local image region instead of the previous works that optimize a high-confidence target in the image. Specifically, we split a victim image into non-overlap blocks and jointly mount a targeted attack on each block. Such a strategy mitigates transfer failures caused by attention inconsistency between surrogate and victim models and thus results in stronger transferability. Our approach is method-agnostic, which means it can be easily combined with existing transferable attacks for even higher transferability. Extensive experiments on ImageNet demonstrate that the proposed approach universally improves the state-of-the-art targeted attacks by a clear margin, e.g., the transferability of the widely adopted Logit attack can be improved by 28.8%-300%. We also evaluate the crafted AEs on a real-world platform: Google Cloud Vision. Results further support the superiority of the proposed method.

With much longer optimization time than that of untargeted attacks notwithstanding, the transferability of targeted attacks is still far from satisfactory. Recent studies reveal that fine-tuning an existing adversarial example (AE) in feature space can efficiently boost its targeted transferability. However, existing fine-tuning schemes only utilize the endpoint and ignore the valuable information in the fine-tuning trajectory. Noting that the vanilla fine-tuning trajectory tends to oscillate around the periphery of a flat region of the loss surface, we propose averaging over the fine-tuning trajectory to pull the crafted AE towards a more centered region. We compare the proposed method with existing fine-tuning schemes by integrating them with state-of-the-art targeted attacks in various attacking scenarios. Experimental results uphold the superiority of the proposed method in boosting targeted transferability. The code is available at github.com/zengh5/Avg_FT.

Deep neural networks (DNNs) are susceptible to adversarial examples (AEs), which are crafted by adding human-imperceptible perturbations to benign images. Although many existing adversarial attacks have achieved great surrogate, white-box model attack performance, they exhibit low transferability. In this work, we emphasize that existing input transformation-based attacks, which linearly mix the input image with images from other categories, induce significant semantic shifts and lack sufficient input diversity, leading to inaccurate update directions. To overcome the pitfall, we propose a new attack method for constructing multiple adversarial trajectories (MAT). Specifically, MAT achieves the intent of the mixing strategy by introducing targeted perturbations instead of relying on input transformation to obtain multiple data points that are closer to the decision boundary for gradient computation. Comprehensive experiments demonstrate our method’s effectiveness. We also show that MAT is highly flexible and can seamlessly integrate with existing transfer methods. Code is available at: github.com/britney-code/MAT-Attack.

Adversarial attacks against ship targets are urgently needed to enhance naval stealth capabilities but face dual bottlenecks of data scarcity and physical implementation. Existing datasets fail to cover multi-view characteristics of complex aquatic environments, which restricts the optimization of adversarial textures. Compared to current mature vehicle adversarial attacks, traditional attack methods prove ineffective when applied to ships due to discontinuous surfaces (e.g., containers/decks) and dynamic waterborne interference (illumination fluctuations and wide viewing-angle variations). To address these issues, we proposed FCA-MARS (Full-Coverage Adversarial Camouflage for Few-Shot Ships with Multi-Angle Attack Robustness), a framework that combines Full-Coverage Adversarial rendering with marine-specific EOT optimization. First, we constructed the field's first high-fidelity ship dataset using Unreal Engine 4(UE4), containing over$\text{1 4, 0 0 0}$multi-scenario samples to overcome few-shot limitations. Second, we integrated differentiable rendering with the Expectation Over Transformation (EOT) framework. This integration achieved geometry-adaptive texture mapping on discontinuous surfaces while maintaining robustness against environmental disturbances. Experimental validation demonstrated strong results: an$\text{8 3. 4 \%}$attack success rate (ASR) in digital tests, 86.5% ASR in physical simulations, and a 98.25% close-range evasion rate. This approach established a physically deployable solution for maritime defense by solving the persistent challenge of camouflaging complex discontinuous geometries.

Transfer-based adversarial attacks craft perturbations on a surrogate and transfer them to black-box models, yet most prior methods diversify perturbations in only one domain, spatial or frequency, which limits overall transferability. We introduce Frequency-Channel-Structure Augmentation, FCSA, a multi-domain attack that jointly enriches perturbations in the frequency, color-channel, and spatial-structure spaces. FCSA couples lightweight frequency masking with Channel Fusion, a stochastic linear mixing across RGB channels, and MultiPattern Structured Perturbation that injects multi-orientation and multi-scale texture fields. The branch gradients are fused with data-dependent nonnegative weights normalized to sum to one, yielding a single update direction and reducing inter-branch conflict. By expanding surrogate diversity across complementary domains, FCSA produces adversarial examples with stronger black-box transfer. Extensive experiments demonstrate that our method achieves strong transferability on both standard and defended models. The method can be combined with a wide range of existing techniques to further improve the transferability of adversarial examples. Our code is available at https://github.com/zhangyuguai/FCSA-Attack.

Adversarial examples (AEs) have been extensively studied due to their potential for privacy protection and inspiring robust neural networks. Yet, making a targeted AE transferable across unknown models remains challenging. In this paper, to alleviate the overfitting dilemma common in an AE crafted by existing simple iterative attacks, we propose fine-tuning it in the feature space. Specifically, starting with an AE generated by a baseline attack, we encourage the features conducive to the target class and discourage the features to the original class in a middle layer of the source model. Extensive experiments demonstrate that only a few iterations of fine-tuning can boost existing attacks' targeted transferability nontrivially and universally. Our results also verify that the simple iterative attacks can yield comparable or even better transferability than the resource-intensive methods, which rest on training target-specific classifiers or generators with additional data. The code is available at: github.com/zengh5/TA_feature_FT.

Adversarial examples are intentionally designed images to force convolution neural networks to give error classification outputs. Existing attacks have constructed transferable adversarial examples from the base attack algorithm, data augmentation, ensemble model, etc. Nevertheless, under the black-box case especially facing defense models, the transferability of adversarial examples still needs to be improved. In this paper, we try to develop a better base attack to boost the transferability of adversarial examples. Through analyzing the baseline gradient-based attacks, we found their iterative procedures of updating gradients are similar to numerical Euler’s methods. From the perspective of numerical analysis, we employ an enhanced Euler’s method, with less approximate errors and thus more accurate, to search a better approximate optimal solution to construct a more transferable gradient-based attack. To this end, we apply two-step gradient calculations of the enhanced Euler’s method to correct gradient descent directions. As a base attack, our attacks can be easily integrated with data augmentations and ensemble model augmentations. Experimental results show the proposed augmented attack significantly improves the transferability of adversarial examples and achieves an average attack success rate at least 3% higher than state-of-the-arts under black-box settings with defense mechanisms.

It is well known that rotation introduces periodic artifacts into the resulting image. By measuring such periodicities, the rotation angle θ can be estimated from the rotated image without the availability of the original unrotated image. However, existing methods suffer from harmonics, especially when θ is small. This paper revisits the harmonics caused by rotation in the cyclic spectrum and points out that such harmonics can help our rotation angle estimation if used effectively. Based on this observation, we propose aggregating the magnitudes of the candidate peaks and their harmonics in detecting the rotation-specific peak. Both theoretical analyses and experimental results demonstrate the advantage of the proposed scheme over previous methods.

Convolutional neural networks (CNNs) are vulnerable to adversarial examples (AEs). Existing feature-level attacks explore the neuron importance to distort the intrinsic object-aware features which are shareable among different CNNs, thus achieving great performance in transferability. In this work, we propose an enhanced neuron attribution-based attack via pixel dropping (ENAA) and try to increase the number of positive neurons to distort the object-aware features more fully than NAA. Specifically, when computing neuron attribution, we use a pixel dropping scheme to expand the regions where the source model pays attention to the image. Our ENAA can make the target model shift the attention regions of AEs far away from those of clean images. Experimental results validate that the proposed method outperforms the state-of-the-art feature-level attacks both in white-box and black-box settings.

Despite the increasing attack ability and transferability of adversarial examples (AE), their security, i.e., how unlikely they can be detected, has been ignored more or less. Without the ability to circumvent popular detectors, the chance that an AE successfully fools a deep neural network is slim. This paper gives a game theory analysis of the interplay between an AE attacker and an AE detection investigator. Taking the perspective of a third party, we introduce a game theory model to evaluate the ultimate performance when both the attacker and the investigator are aware of each other. Further, a Bayesian game is adopted to address the information asymmetry in practice. Solving the mixed-strategy Nash equilibrium of the game, both parties’ optimal strategies are obtained, and the security of AEs can be evaluated. We evaluate four popular attacks under a two-step test on ImageNet. The results may throw light on how a farsighted attacker or investigator will act in this adversarial environment. Our code is available at: https://github.com/zengh5/AED_BGame.

While extensive studies have pushed the limit of the transferability of untargeted attacks, transferable targeted attacks remain extremely challenging. This paper finds that the labels with high confidence in the source model are also likely to retain high confidence in the target model. This simple and intuitive observation inspires us to carefully deal with the high-confidence labels in generating targeted adversarial examples for better transferability. Specifically, we integrate the untargeted loss function into the targeted attack to push the adversarial examples away from the original label while approaching the target label. Furthermore, we suppress other high-confidence labels in the source model with an orthogonal gradient. We validate the proposed scheme by mounting targeted attacks on the ImageNet dataset. Experiments on various scenarios show that our proposed scheme improves the state-of-the-art targeted attacks in transferability. Our code is available at: https://github.com/zengh5/Transferable_targeted_attack.

In this work, we propose an enhanced adversarial attack based on DAG, to improve the transferability of adversarial example to fool CNN-based object detectors. DAG achieves excellent performance under white-box settings via attacking the detection head, but has poor transferability under black-box cases. We jointly attack the feature map of backbone and the detection head to improve the transferability. Because, we think the attack against high-level feature of backbone can transfer to disturb other homogeneous CNN-based backbones. To this end, we optimize the combination of feature loss of backbone and classification loss of region proposals to generate adversarial examples. Extensive experiments on PASCAL VOC and COCO datasets demonstrate that our attack can transfer to attack the detector with different backbone or different pipelines even under defense situations, and has achieved superior transferability than state-of-the-arts.

Existing adversarial example generation algorithms mainly consider the success rate of spoofing target model, but pay little attention to its own security. In this paper, we propose the concept of adversarial example security as how unlikely themselves can be detected. A two-step test is proposed to deal with the adversarial attacks of different strengths. Game theory is introduced to model the interplay between the attacker and the investigator. By solving Nash equilibrium, the optimal strategies of both parties are obtained, and the security of the attacks is evaluated. Five typical attacks are compared on the ImageNet. The results show that a rational attacker tends to use a relatively weak strength. By comparing the ROC curves under Nash equilibrium, it is observed that the constrained perturbation attacks are more secure than the optimized perturbation attacks in face of the two-step test. The proposed framework can be used to evaluate the security of various potential attacks and further the research of adversarial example generation/detection.

Scale-invariant method (SIM) is a state-of-the-art model augmentation method to improve the transferability of adversarial examples. However, we find that SIM is easily affected by the scaling operation with small scaling factors, and cannot stably enhance the transferability of the base attack. In this paper, we propose an enhanced transferable attack based on SIM. To alleviate the instability of SIM caused by the scaled copy which does not satisfy scale-invariance, we propose to ensemble logit-outputs of scale copies of the input image, rather than ensemble the gradients, to form an ensemble attack that generates transferable adversarial images from multiple models of the original CNN model. Compared with the existing ensemble methods, our method is fast yet effective and can be easily integrated into the gradient-based attacks. The experimental results show that the proposed integrated EL-NI-FGSM attack stably improves the transferability of NI-FGSM, and outperforms SI-NI-FGSM, achieving >8% higher of attack success rate for both white-box and black-box attacks on CIFAR-10.

In this paper, we focus on detecting adversarial images generated by the white-box adversarial attack proposed by Carlini and Wagner (C&W for short). The C&W attack is one of the most powerful attacks which has achieved nearly 100% attack success rates for fooling deep neural network (DNN) yet keeping the visual quality of adversarial image. Considering that the C&W attack optimizes a loss function based on the logit layer of DNN to find adversarial perturbations, we first add Gaussian noise to destroy the perturbations. For the high-confidence adversarial image, a strong Gaussian noise is employed. In order to reduce the impact of such strong noise on a legitimate image, a FFDNet filter is utilized to execute denoising. By comparing the prediction on a test image with that on its noise added-then-denoised version, the proposed method detects the test image as adversarial when the predictions are different. The experiments on ImageNet show that the proposed method can effectively detect targeted and un-targeted C&W adversarial images generated on famous models: Resnet-50, Inception v2, and Inception v3, achieving higher F1 scores than the-state-of-art.

Image forensics with the presence of an adversary, such as the interplay between the sensor-based camera source identification (CSI) and the fingerprint-copy attack, has attracted increasing attention recently. In this paper, we propose a framework of CSI game with both complete information and incomplete information. A noise level-based counter anti-forensic method is presented to detect the potential fingerprint-copy attack, and unlike the state-of-the-art countermeasure of the triangle test, it does not need to collect the candidate image set. With the existence of countermeasure, a rational forger needs to balance the tradeoff between synthesizing source information and leaving new detectable evidence of raising the noise level of a forged image. The mixed-strategy other than the sequential-move assumption is adopted to solve the games. The Bayesian game is introduced to address the information asymmetry in practice. The Nash equilibrium of both the complete information game and Bayesian game are theoretically analyzed, and the expected Nash equilibrium payoff of a Bayesian game is obtained. Nash equilibrium receiver operating characteristic curves are adopted to evaluate the detection performance. Simulation results show that the information asymmetry can remarkably affect the final detection performance. To our knowledge, this paper is the first attempt in analyzing a Bayesian forensic game with practical information asymmetry.

Image resampling leaves behind periodical artifacts which are used as fingerprints for the forensics. A knowledgeable anti-forensic method erases such artifacts by irregular sampling. We observe that the irregular sampling followed by interpolation causes changes in local linear correlations, and propose a novel method to detect the anti-forensic method of resampling via partial autocorrelation coefficients. Experimental results on a large set of images show that the proposed method could effectively detect the anti-forensics of resampling with a low dimensional feature set.

Sensor-based camera source identification (CSI) is believed to be an effective tool for linking a photograph to its source camera. In this paper, we propose a photo response non-uniformity (PRNU) removing attack on CSI. The PRNU fingerprint is a kind of multiplicative noise, and is believed to be difficult to be removed from an image. In this work, both the pattern and magnitude of the PRNU fingerprint of an unaltered image are estimated first, then it is subtracted from the target image. Theoretical analysis and experimental results show that the PRNU fingerprint can be removed using only common processing techniques without introducing visual artefact, therefore CSI can be easily defeated.

The statistical fingerprints left by median filtering can be a valuable clue for image forensics. However, these fingerprints may be maliciously erased by a forger. Recently, a tricky anti-forensic method has been proposed to remove median filtering traces by restoring images' pixel difference distribution. In this paper, we analyze the traces of this anti-forensic technique and propose a novel counter method. The experimental results show that our method could reveal this anti-forensics effectively at low computation load. According to our best knowledge, it's the first work on countering anti-forensics of median filtering.

Although sensor pattern noise (SPN) is recognized as a reliable device fingerprint for camera source identification (CSI), this fingerprint could have been forged by anti-forensics. In order to evaluate the performance in the case of both forensic investigator and forger exist, we model this interplay as a camera source identification game. The mixed-strategy Nash equilibrium is introduced to solve this game. The Nash equilibrium receiver operating characteristic (ROC) curves are obtained experimentally. Through our analysis, we are able to determine under which case the CSI result is reliable.