PMID- 34955802 OWN - NLM STAT- PubMed-not-MEDLINE LR - 20211227 IS - 1662-5218 (Print) IS - 1662-5218 (Electronic) IS - 1662-5218 (Linking) VI - 15 DP - 2021 TI - Improving the Transferability of Adversarial Examples With a Noise Data Enhancement Framework and Random Erasing. PG - 784053 LID - 10.3389/fnbot.2021.784053 [doi] LID - 784053 AB - Deep neural networks (DNNs) are proven vulnerable to attack against adversarial examples. Black-box transfer attacks pose a massive threat to AI applications without accessing target models. At present, the most effective black-box attack methods mainly adopt data enhancement methods, such as input transformation. Previous data enhancement frameworks only work on input transformations that satisfy accuracy or loss invariance. However, it does not work for other transformations that do not meet the above conditions, such as the transformation which will lose information. To solve this problem, we propose a new noise data enhancement framework (NDEF), which only transforms adversarial perturbation to avoid the above issues effectively. In addition, we introduce random erasing under this framework to prevent the over-fitting of adversarial examples. Experimental results show that the black-box attack success rate of our method Random Erasing Iterative Fast Gradient Sign Method (REI-FGSM) is 4.2% higher than DI-FGSM in six models on average and 6.6% higher than DI-FGSM in three defense models. REI-FGSM can combine with other methods to achieve excellent performance. The attack performance of SI-FGSM can be improved by 22.9% on average when combined with REI-FGSM. Besides, our combined version with DI-TI-MI-FGSM, i.e., DI-TI-MI-REI-FGSM can achieve an average attack success rate of 97.0% against three ensemble adversarial training models, which is greater than the current gradient iterative attack method. We also introduce Gaussian blur to prove the compatibility of our framework. CI - Copyright (c) 2021 Xie, Shi, Yang, Qiao, Liang, Wang, Chen, Hu and Yan. FAU - Xie, Pengfei AU - Xie P AD - Henan Key Laboratory of Imaging and Intelligent Processing, PLA Strategy Support Force Information Engineering University, Zhengzhou, China. FAU - Shi, Shuhao AU - Shi S AD - Henan Key Laboratory of Imaging and Intelligent Processing, PLA Strategy Support Force Information Engineering University, Zhengzhou, China. FAU - Yang, Shuai AU - Yang S AD - Henan Key Laboratory of Imaging and Intelligent Processing, PLA Strategy Support Force Information Engineering University, Zhengzhou, China. FAU - Qiao, Kai AU - Qiao K AD - Henan Key Laboratory of Imaging and Intelligent Processing, PLA Strategy Support Force Information Engineering University, Zhengzhou, China. FAU - Liang, Ningning AU - Liang N AD - Henan Key Laboratory of Imaging and Intelligent Processing, PLA Strategy Support Force Information Engineering University, Zhengzhou, China. FAU - Wang, Linyuan AU - Wang L AD - Henan Key Laboratory of Imaging and Intelligent Processing, PLA Strategy Support Force Information Engineering University, Zhengzhou, China. FAU - Chen, Jian AU - Chen J AD - Henan Key Laboratory of Imaging and Intelligent Processing, PLA Strategy Support Force Information Engineering University, Zhengzhou, China. FAU - Hu, Guoen AU - Hu G AD - Henan Key Laboratory of Imaging and Intelligent Processing, PLA Strategy Support Force Information Engineering University, Zhengzhou, China. FAU - Yan, Bin AU - Yan B AD - Henan Key Laboratory of Imaging and Intelligent Processing, PLA Strategy Support Force Information Engineering University, Zhengzhou, China. LA - eng PT - Journal Article DEP - 20211209 PL - Switzerland TA - Front Neurorobot JT - Frontiers in neurorobotics JID - 101477958 PMC - PMC8696674 OTO - NOTNLM OT - adversarial examples OT - black-box attack OT - data enhancement OT - transfer-based attack OT - transferability COIS- The authors declare that the research was conducted in the absence of any commercial or financial relationships that could be construed as a potential conflict of interest. EDAT- 2021/12/28 06:00 MHDA- 2021/12/28 06:01 PMCR- 2021/01/01 CRDT- 2021/12/27 06:23 PHST- 2021/09/27 00:00 [received] PHST- 2021/11/04 00:00 [accepted] PHST- 2021/12/27 06:23 [entrez] PHST- 2021/12/28 06:00 [pubmed] PHST- 2021/12/28 06:01 [medline] PHST- 2021/01/01 00:00 [pmc-release] AID - 10.3389/fnbot.2021.784053 [doi] PST - epublish SO - Front Neurorobot. 2021 Dec 9;15:784053. doi: 10.3389/fnbot.2021.784053. eCollection 2021.