CFA: Consistent Feature Attribution for Black-Box Adversarial Attack Against Object Detection

Adversarial attack methods in black-box settings based on transferability have garnered significant attention. The inherent transferability of adversarial examples allows them to attack DNN models with unknown structures and parameters. Investigating the source of their transferability can help reveal the internal working mechanisms of DNN models and enhance their interpretability. Feature-level attack, a type to perform black-box adversarial attack, fully utilizes the internal information of models. To improve the transferability of feature-level attacks in the object detection task, this paper proposes to interact with the middle and deep feature maps of the backbone network of the object detector using the clean image and the corresponding gradients to explore the consistency of the model's inference logic reflected in the feature maps. We design a consistent feature attribution loss function to guide the adversarial patch to disrupt features that are beneficial for the model's correct predictions. We obtained transferable adversarial patches through this approach, and experimental results demonstrate the effectiveness of our proposed method. Our project's code will be available at https://github.com/BUCT-IUSRC/Research_CFA.