Object-attentional untargeted adversarial attack

Deep neural networks are facing severe threats from adversarial attacks. Most existing black -box attacks fool the target model by generating either global perturbations or local patches. However, both global perturbations and local patches easily cause annoying visual artifacts in the adversarial example. Compared with some smooth regions of an image, the object region generally has more edges and a more complex texture. Thus, small perturbations on it will be more imperceptible. On the other hand, the object region is undoubtedly the decisive part of an image to classification tasks. Motivated by these two facts, we propose an objectattentional adversarial attack method for untargeted attacks. Specifically, we first generate an object region by intersecting the object detection region from YOLOv4 with the salient object detection (SOD) region from HVPNet. Furthermore, we design an activation strategy to avoid the reaction caused by the incomplete SOD. Then, we perform an adversarial attack only on the detected object region by leveraging a Simple Black -box Adversarial Attack (SimBA). To verify the proposed method, we create a unique dataset by extracting all the images containing the object defined by COCO from ImageNet-1K, named COCO-Reduced-ImageNet in this paper. Experimental results on ImageNet-1K and COCO-Reduced-ImageNet show that under various system settings, our method yields the adversarial example with better perceptual quality while saving the query budget up to 24.16% compared to the state-of-the-art approaches including SimBA. The code is available at https://github.com/GZHU-DVL/OA.