提出一种低秩对抗攻击，比传统方法更省内存且效果相当。
Low-Rank Adversarial PGD Attack
- 基于图像扰动多集中在部分奇异值谱的观察，设计低秩PGD攻击
- 在多个标准与鲁棒模型上验证，性能媲美甚至超越全秩攻击
- 实现简单快速，适合用于对抗训练，尤其适合资源受限场景
深度神经网络的对抗攻击发展迅速，广泛用于研究模型稳定性。在各类攻击策略中，投影梯度下降（PGD）因高效易实现而被计算机视觉领域广泛采用，适用于对抗训练。本文观察到，多数情况下PGD生成的扰动仅影响原图像奇异值谱的一小部分，表明其近似低秩。受此启发，我们提出一种高效的低秩PGD攻击方法。我们在多种标准模型及经过对抗训练的鲁棒模型上进行了充分验证。结果表明，该低秩PGD可有效用于对抗训练，因其实现简单、速度快且性能优异。值得注意的是，低秩PGD在多数情况下表现与全秩攻击相当，甚至更优，同时显著降低内存消耗。
原文摘要 · Abstract (English)
Adversarial attacks on deep neural network models have seen rapid development and are extensively used to study the stability of these networks. Among various adversarial strategies, Projected Gradient Descent (PGD) is a widely adopted method in computer vision due to its effectiveness and quick implementation, making it suitable for adversarial training. In this work, we observe that in many cases, the perturbations computed using PGD predominantly affect only a portion of the singular value spectrum of the original image, suggesting that these perturbations are approximately low-rank. Motivated by this observation, we propose a variation of PGD that efficiently computes a low-rank attack. We extensively validate our method on a range of standard models as well as robust models that have undergone adversarial training. Our analysis indicates that the proposed low-rank PGD can be effectively used in adversarial training due to its straightforward and fast implementation coupled with competitive performance. Notably, we find that low-rank PGD often performs comparably to, and sometimes even outperforms, the traditional full-rank PGD attack, while using significantly less memory.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。