通过关注显著区域和加权特征丢弃,提升对抗样本的目标迁移性。
Boosting the Targeted Transferability of Adversarial Examples via Salient Region & Weighted Feature Drop
- 基于显著区域生成辅助图像,引导对抗样本特征向目标类别转移。
- 引入加权特征丢弃机制,降低对替代模型的过拟合,提升迁移成功率。
- 在普通与鲁棒模型上分别提升16.31%和7.06%攻击成功率,适合黑盒攻击研究者。
深度神经网络容易受到对抗样本的攻击,对实际应用构成重大风险。现有对抗攻击方法依赖于对抗样本的迁移性,即在替代模型上生成的对抗样本用于攻击未知的黑盒模型。尽管已有多种提升迁移性的方法,但目标型黑盒攻击仍受限于对抗样本对替代模型的过拟合问题。本文提出一种基于显著区域与加权特征丢弃(SWFD)的新框架,以增强对抗样本的目标迁移性。基于高迁移性样本在深层输出中具有更平滑分布的观察,我们设计了加权特征丢弃机制,根据激活值的范数分布进行加权调节,有效缓解生成过程中的过拟合。同时,利用图像中的显著区域构造辅助图像,实现模型无关的特征迁移,从而提升迁移性。大量实验表明,所提方法在多种配置下均优于当前最优方法:平均而言,对正常训练模型的攻击成功率提升16.31%,对鲁棒模型提升7.06%。
原文摘要 · Abstract (English)
Deep neural networks can be vulnerable to adversarially crafted examples, presenting significant risks to practical applications. A prevalent approach for adversarial attacks relies on the transferability of adversarial examples, which are generated from a substitute model and leveraged to attack unknown black-box models. Despite various proposals aimed at improving transferability, the success of these attacks in targeted black-box scenarios is often hindered by the tendency for adversarial examples to overfit to the surrogate models. In this paper, we introduce a novel framework based on Salient region & Weighted Feature Drop (SWFD) designed to enhance the targeted transferability of adversarial examples. Drawing from the observation that examples with higher transferability exhibit smoother distributions in the deep-layer outputs, we propose the weighted feature drop mechanism to modulate activation values according to weights scaled by norm distribution, effectively addressing the overfitting issue when generating adversarial examples. Additionally, by leveraging salient region within the image to construct auxiliary images, our method enables the adversarial example's features to be transferred to the target category in a model-agnostic manner, thereby enhancing the transferability. Comprehensive experiments confirm that our approach outperforms state-of-the-art methods across diverse configurations. On average, the proposed SWFD raises the attack success rate for normally trained models and robust models by 16.31% and 7.06% respectively.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。