Neural networks perform exceedingly well across various machine learning
tasks but are not immune to adversarial perturbations. This vulnerability has
implications for real-world applications. While much research has been
conducted, the underlying reasons why neural networks fall prey to adversarial
attacks are not yet fully understood. Central to our study, which explores up
to five attack algorithms across three datasets, is the identification of
human-identifiable features in adversarial perturbations. Additionally, we
uncover two distinct effects manifesting within human-identifiable features.
Specifically, the masking effect is prominent in untargeted attacks, while the
generation effect is more common in targeted attacks. Using pixel-level
annotations, we extract such features and demonstrate their ability to
compromise target models. In addition, our findings indicate a notable extent
of similarity in perturbations across different attack algorithms when averaged
over multiple models. This work also provides insights into phenomena
associated with adversarial perturbations, such as transferability and model
interpretability. Our study contributes to a deeper understanding of the
underlying mechanisms behind adversarial attacks and offers insights for the
development of more resilient defense strategies for neural networks.

研究表明，神经网络在各种机器学习任务中表现出色，但仍然容易受到对抗性扰动的攻击。这篇论文探讨了对抗性攻击中人可识别特征的识别，并揭示了在无目标攻击和有目标攻击中出现的两种不同效应。通过提取像素级注释的特征，论文证明了这些特征能够破坏目标模型，并指出不同攻击算法在多个模型上平均后的扰动具有显著的相似性。该研究为更深入地理解对抗性攻击的机制及神经网络的防御策略提供了洞察。