Most of the adversarial attack methods suffer from large perceptual
distortions such as visible artifacts, when the attack strength is relatively
high. These perceptual distortions contain a certain portion which contributes
less to the attack success rate. This portion of distortions, which is induced
by unnecessary modifications and lack of proper perceptual distortion
constraint, is the target of the proposed framework. In this paper, we propose
a perceptual distortion reduction framework to tackle this problem from two
perspectives. We guide the perturbation addition process to reduce unnecessary
modifications by proposing an activated region transfer attention mask, which
intends to transfer the activated regions of the target model from the correct
prediction to incorrect ones. Note that an ensemble model is adopted to predict
the activated regions of the unseen models in the black-box setting of our
framework. Besides, we propose a perceptual distortion constraint and add it
into the objective function of adversarial attack to jointly optimize the
perceptual distortions and attack success rate. Extensive experiments have
verified the effectiveness of our framework on several baseline methods.

By admin