只知最终模型时，也能高效攻击多模型系统。
Keep on Swimming: Real Attackers Only Need Partial Knowledge of a Multi-Model System
- 仅用末尾黑盒模型的代理，构造全局对抗样本。
- 成功率80%（前人25%），扰动大小减少9.4% MSE。
- 适合真实场景下信息受限的攻击者参考。
当前机器学习常采用多模型组合或代理架构完成任务。针对此类系统进行对抗攻击时，训练端到端代理模型或每个组件的代理模型在计算或信息上可能不可行。本文提出一种新方法，在仅拥有最终黑盒模型代理的情况下，仍可对整个多模型系统实施有效攻击，且能应对初始模型变换导致扰动失效的问题。现有方法通常通过多次复制首阶段模型并平均梯度，或分别学习两阶段代理模型。据我们所知，这是首个专为该威胁模型设计的攻击方法。实验表明，本方法攻击成功率达80%（相比前人最优25%），扰动均方误差（MSE）降低9.4%。研究聚焦于监督图像处理流水线，但作者认为该攻击可推广至其他多模型设置（如开源/闭源基础模型混合）或代理系统。
原文摘要 · Abstract (English)
Recent approaches in machine learning often solve a task using a composition of multiple models or agentic architectures. When targeting a composed system with adversarial attacks, it might not be computationally or informationally feasible to train an end-to-end proxy model or a proxy model for every component of the system. We introduce a method to craft an adversarial attack against the overall multi-model system when we only have a proxy model for the final black-box model, and when the transformation applied by the initial models can make the adversarial perturbations ineffective. Current methods handle this by applying many copies of the first model/transformation to an input and then re-use a standard adversarial attack by averaging gradients, or learning a proxy model for both stages. To our knowledge, this is the first attack specifically designed for this threat model and our method has a substantially higher attack success rate (80% vs 25%) and contains 9.4% smaller perturbations (MSE) compared to prior state-of-the-art methods. Our experiments focus on a supervised image pipeline, but we are confident the attack will generalize to other multi-model settings [e.g. a mix of open/closed source foundation models], or agentic systems
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。