仅改一个向量索引，就能在压缩域发动高效攻击
One-Index Vector Quantization Based Adversarial Attack on Image Classification
- 通过差分进化算法优化单个向量量化索引生成对抗样本
- 在CIFAR-10和Fashion MNIST上分别实现55.9%和77.4%的攻击成功率
- 适用于真实场景中的半黑盒攻击，扰动小且隐蔽性强
为提升存储与传输效率，图像通常经过压缩。向量量化（VQ）因其高压缩比而成为主流方法，但现有对抗攻击多在像素域进行，极少涉及压缩域，难以应用于真实场景。本文提出一种基于单索引的新型压缩域攻击方法，利用差分进化算法修改压缩数据流中的单一索引，使解压后图像被目标模型误分类。该方法仅需调整一个VQ索引即可完成攻击，显著减少扰动点数量。属于半黑盒攻击，更贴近实际攻击环境。实验在ResNet、NIN和VGG16三个主流分类模型上验证，平均在CIFAR-10上成功攻击55.9%的图像，在Fashion MNIST上达77.4%，具备高误分类置信度与低图像扰动水平。
原文摘要 · Abstract (English)
To improve storage and transmission, images are generally compressed. Vector quantization (VQ) is a popular compression method as it has a high compression ratio that suppresses other compression techniques. Despite this, existing adversarial attack methods on image classification are mostly performed in the pixel domain with few exceptions in the compressed domain, making them less applicable in real-world scenarios. In this paper, we propose a novel one-index attack method in the VQ domain to generate adversarial images by a differential evolution algorithm, successfully resulting in image misclassification in victim models. The one-index attack method modifies a single index in the compressed data stream so that the decompressed image is misclassified. It only needs to modify a single VQ index to realize an attack, which limits the number of perturbed indexes. The proposed method belongs to a semi-black-box attack, which is more in line with the actual attack scenario. We apply our method to attack three popular image classification models, i.e., Resnet, NIN, and VGG16. On average, 55.9% and 77.4% of the images in CIFAR-10 and Fashion MNIST, respectively, are successfully attacked, with a high level of misclassification confidence and a low level of image perturbation.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。