Improvement in the Transferability of Target Adversarial Examples Based on Data Augmentation

Despite the high performance of deep neural networks in image classification, they are very sensitive to those adversarial examples with small perturbations, which is likely to cause classification errors. Currently, there are various adversarial attack methods developed, but the adversarial samples generated using most methods are still disadvantaged by the poor target ransferability of cross-model in black-box scenarios. To address this issue, a new method called Adaptive Variation Method (AVM) is proposed in this paper to improve the transferability of targeted adversarial examples in black-box scenarios. AVM relies on Adjustment of diversified inputs(ADI) method to achieve data enhancement on the input image and Maximum absolute difference (MD) method to calculate the loss for adversarial perturbation. Specifically, the Resized-Diverse-Inputs (RDI) method is improved in this paper to propose a new diversified input method, namely the Adjustment of diversified inputs (ADI) method. By means of repeated scaling and random filling performed on the input image, the image becomes relatively rough, with its input diversity and random flexibility improved. In addition, the Maximum absolute difference (MD) method is proposed in this paper to enhance the advantage of adversarial samples by minimizing the maximum absolute difference between the adversarially perturbed global image and local image. According to the experimental results, this method improves the success rate in the presence of transfer-based targeted attacks.