This paper proposes a novel framework to improve the transferability of generative adversarial attacks. Existing generative adversarial attacks have the problem that adversarial perturbations are not well aligned with the critical regions of the object due to the insufficient representational capabilities of generative models. In this paper, we present a Mean Teacher-based semantic structure-aware attack framework that generates perturbations by utilizing semantic information extracted from intermediate activations of the generator. In particular, we use feature distillation, a technique that enhances the consistency between the early layer activations of the student model and the activations of the semantically rich teacher model, to induce perturbations to be focused on the critical regions of the object. The proposed method demonstrates superior transferability over existing methods across various models, domains, and tasks, and is evaluated by existing and newly proposed Accidental Correction Rate (ACR) metrics.
