HRFA: High-Resolution Feature-based Attack
  Adversarial attacks have long been developed for revealing the vulnerability
of Deep Neural Networks (DNNs) by adding imperceptible perturbations to the
input. Most methods generate perturbations like normal noise, which is not
interpretable and without semantic meaning. In this paper, we propose
High-Resolution Feature-based Attack (HRFA), yielding authentic adversarial
examples with up to $1024 \times 1024$ resolution. HRFA exerts attack by
modifying the latent feature representation of the image, i.e., the gradients
back propagate not only through the victim DNN, but also through the generative
model that maps the feature space to the image space. In this way, HRFA
generates adversarial examples that are in high-resolution, realistic,
noise-free, and hence is able to evade several denoising-based defenses. In the
experiment, the effectiveness of HRFA is validated by attacking the object
classification and face verification tasks with BigGAN and StyleGAN,
respectively. The advantages of HRFA are verified from the high quality, high
authenticity, and high attack success rate faced with defenses.
