We consider the blackbox transfer-based targeted adversarial attack threat
model in the realm of deep neural network (DNN) image classifiers. Rather than
focusing on crossing decision boundaries at the output layer of the source
model, our method perturbs representations throughout the extracted feature
hierarchy to resemble other classes. We design a flexible attack framework that
allows for multi-layer perturbations and demonstrates state-of-the-art targeted
transfer performance between ImageNet DNNs. We also show the superiority of our
feature space methods under a relaxation of the common assumption that the
source and target models are trained on the same dataset and label space, in
some instances achieving a $10\times$ increase in targeted success rate
relative to other blackbox transfer methods. Finally, we analyze why the
proposed methods outperform existing attack strategies and show an extension of
the method in the case when limited queries to the blackbox model are allowed.

该研究讨论在深度神经网络（DNN）图像分类器范围内的黑盒传递目标对抗攻击威胁模型，提出的方法通过扰动特征层级上的表示来模仿其他类别，使用灵活的攻击框架显示出 ImageNet DNNs 之间的最新目标传输性能，并说明其优越性，相比于其他黑盒传输方法，成功率提高了 10 倍，该方法胜过现有的攻击策略，并在有限的黑盒模型查询情况下同时展示了该方法的扩展性。