用知识蒸馏生成可证明迁移的对抗样本，大幅降低攻击查询次数。
Model Mimic Attack: Knowledge Distillation for Provably Transferable Adversarial Examples
- 通过迭代训练学生模型，逐步扩大数据集提升攻击能力。
- 证明只要学生模型足够强，有限次蒸馏后必能攻破教师模型。
- 适合研究对抗攻击、安全防御的学者，尤其关注高效黑盒攻击者。
人工神经网络在黑盒设置下对对抗扰动的脆弱性已被广泛研究。现有攻击方法大多需要大量查询才能生成对抗样本，实用性受限。本文聚焦于知识蒸馏，提出一种在不断扩展的数据集上迭代训练代理模型的方法。据我们所知，这是首个为基于知识蒸馏的黑盒攻击提供可证明成功率保障的工作：若学生模型具备足够学习能力，攻击教师模型将在有限次蒸馏迭代内被保证成功。
原文摘要 · Abstract (English)
The vulnerability of artificial neural networks to adversarial perturbations in the black-box setting is widely studied in the literature. The majority of attack methods to construct these perturbations suffer from an impractically large number of queries required to find an adversarial example. In this work, we focus on knowledge distillation as an approach to conduct transfer-based black-box adversarial attacks and propose an iterative training of the surrogate model on an expanding dataset. This work is the first, to our knowledge, to provide provable guarantees on the success of knowledge distillation-based attack on classification neural networks: we prove that if the student model has enough learning capabilities, the attack on the teacher model is guaranteed to be found within the finite number of distillation iterations.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。