AG2: Attention-Guided Dynamic Adaptation for Adversarial Attacks in Computer Vision

Deep neural networks (DNNs) have achieved remarkable success in computer vision yet remain vulnerable to adversarial examples. Existing attacks typically distribute perturbations uniformly across the input, without leveraging the model’s internal attention mechanism, and fail to adapt to model responses. To tackle these limitations, we propose AG2 (Attention-Guided Adversarial Sample Generation), an adversarial attack algorithm that uses dynamically updated attention maps to guide perturbation placement and a dynamic feedback mechanism for adaptive optimization. AG2 comprises three steps: feature extraction and attention-weight computation, iterative optimization of perturbations guided by attention maps, and adjustment of optimization parameters based on attention shifts. By concentrating perturbations in regions receiving high attention from the victim model, AG2 improves attack effectiveness while preserving visual imperceptibility. The dynamic feedback mechanism further maintains robustness against defended models such as those trained with defensive distillation. Experiments on MNIST, CIFAR-10, and ImageNet show that AG2 achieves attack success rates of 93.7%, 93.5%, and 85.0%, respectively, outperforming prior methods. Moreover, AG2 exhibits strong cross-architecture transferability, achieving a 69.5% success rate on Vision Transformers, which is higher than the previous method’s 55.3% by 14.2%. Theoretical analysis provides convergence guarantees and stability bounds for the proposed attention-guided optimization.