SMGEA

SMGEA implements a serial-minigroup ensemble adversarial attack that enhances transferability of adversarial examples across deep neural networks to evaluate black-box model robustness.

Key Features:

• Minigroup Division: Divides a set of pretrained white-box source models into multiple minigroups for grouped adversarial information management.
• Intragroup Ensemble Strategies: Employs three novel ensemble strategies per minigroup to improve intragroup transferability of adversarial examples.
• Long-Term Gradient Memory Accumulation: Recursively accumulates long-term gradient memories from one minigroup to the next to preserve adversarial information and boost intergroup transferability.
• Empirical Black-box Performance: Demonstrates superior black-box attack success, including successful deception of online saliency prediction systems DeepGaze-II and SALICON.

Scientific Applications:

• Robustness Evaluation: Evaluating robustness of deep neural networks in black-box scenarios where attackers lack access to target model parameters or architecture.
• Adversarial Transferability Research: Studying mechanisms and improvements of adversarial transferability across model ensembles and saliency prediction systems.

Methodology:

Divides pretrained white-box source models into minigroups, applies three ensemble strategies within each minigroup, and recursively accumulates long-term gradient memories across minigroups.