SSTA: Salient Spatially Transformed Attack

Extensive studies have demonstrated that deep neural networks (DNNs) are vulnerable to adversarial examples (AEs), which brings a huge security risk to the application of DNNs, especially for the AI models developed in the real world. To impede the process of fully exploiting the vulnerabilities of existing DNNs and further improving their robustness in the face of such malicious inputs, many attack methods have been proposed to build AEs. Despite the significant progress that has been made recently, existing attack methods still suffer from the unsatisfactory performance of escaping from being detected by naked human eyes due to the formulation of AE heavily relying on a noise-adding manner. Such mentioned challenges will significantly increase the risk of exposure and result in an attack to be failed. Therefore, in this paper, we propose the Salient Spatially Transformed Attack (SSTA), a novel framework to craft imperceptible AEs, which enhance the stealthiness of AEs by estimating a smooth spatial transform metric on a most critical area to generate AEs instead of adding external noise to the whole image. Compared to SOTA baselines, extensive experiments indicated that SSTA could effectively improve the imperceptibility of the AEs while maintaining a 100% attack success rate.