Feature Weight Masked Low-Frequency Object Detection Attack Method

Identifying adversarial examples is beneficial for understanding deep networks and developing robust models. However, the transferability of existing attacking methods for image object detection is weak. This is mainly due to the different categorizations of object detectors, typically categorized into two-stage and single-stage detection models. Adversarial examples for a specific model type often have a low success rate when attacking other detectors. In this paper a new transferable adversarial example generation method called MLFAdv is proposed. This method applies low-frequency adversarial loss and feature loss to enhance the transferability of adversarial examples. To avoid redundant perturbations to non-critical regions to improve the generation efficiency of adversarial examples, MLFAdv uses the feature weight matrix of Gradient-weighted Class Activation Mapping (Grad-CAM) as a mask on clean images to screen out the task-irrelevant areas and guide the adversarial perturbation to focus on salient regions during generating adversarial examples. The experimental results on Pascal VOC show that the proposed MLFAdv method significantly improves the attack transfer rate compared to general adversarial example generation methods and achieves the best attack effect.