Transferable adversarial examples based on global smooth perturbations

Although the attack rate and the imperceptibility of perturbations are two main concerns of adversarial attacks, the transferability of adversarial examples is an emerging topic due to the need for applications. It is known from previous work that adversarial examples with low-frequency perturbations have better transferability than those with high-frequency perturbations. In this paper, we propose a method to generate global smooth low-frequency perturbations with parameterized smooth functions, unlike previous pixel-wise local methods. We optimize perturbations by minimizing a proposed loss function that fulfills the attack task and meets the requirement of imperceptibility for perturbations. The global smoothness of perturbations ensures the spectrum of low-frequency and hence increases adversarial examples’ transferability. In the implementation, the Gaussian mixture model is used as the prototype of parameterized smooth functions to evaluate the proposed method. Extensive experiments on ImageNet and CIFAR-10 demonstrate that our method significantly improves the transferability by 10–20% over other state-of-the-art methods with a comparable attack rate.