通过生成感知等效样本提升对抗样本迁移性，攻击成功率翻倍。
PEAS: A Strategy for Crafting Transferable Adversarial Examples
- 用细微扰动生成感知等效图像集，评估其对抗扰动的迁移能力
- 在ImageNet和CIFAR-10上使攻击成功率平均提升2.5倍
- 适合研究模型安全或防御机制的人员参考
黑盒攻击对机器学习系统构成重大威胁，因攻击者对目标模型了解有限。现有基于替代模型生成的对抗样本迁移性较差。尽管近期方法尝试通过排序扰动提升成功率，但效果仍有限。本文提出新策略PEAS，显著提升已有黑盒攻击的迁移性。核心思想是：感知等效的样本在对抗迁移性上存在显著差异。方法首先对初始样本进行细微增强生成一组图像，再利用多个替代模型评估这些图像上对抗扰动的迁移能力，最终选择迁移性最强的对抗样本用于攻击。实验表明，PEAS可使现有攻击性能翻倍，在ImageNet和CIFAR-10上的攻击成功率平均比当前排名方法提高2.5倍。我们全面评估了PEAS在两个数据集上的表现，分析了超参数影响，并进行了消融实验以验证各组件的重要性。
原文摘要 · Abstract (English)
Black box attacks, where adversaries have limited knowledge of the target model, pose a significant threat to machine learning systems. Adversarial examples generated with a substitute model often suffer from limited transferability to the target model. While recent work explores ranking perturbations for improved success rates, these methods see only modest gains. We propose a novel strategy called PEAS that can boost the transferability of existing black box attacks. PEAS leverages the insight that samples which are perceptually equivalent exhibit significant variability in their adversarial transferability. Our approach first generates a set of images from an initial sample via subtle augmentations. We then evaluate the transferability of adversarial perturbations on these images using a set of substitute models. Finally, the most transferable adversarial example is selected and used for the attack. Our experiments show that PEAS can double the performance of existing attacks, achieving a 2.5x improvement in attack success rates on average over current ranking methods. We thoroughly evaluate PEAS on ImageNet and CIFAR-10, analyze hyperparameter impacts, and provide an ablation study to isolate each component's importance.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。