改进经典PGD攻击，实现更隐蔽的对抗样本。
PGD-Imp: Rethinking and Unleashing Potential of Classic PGD with Dual Strategies for Imperceptible Adversarial Attacks
- 用动态步长和自适应早停提升优化效率
- 未靶向攻击下达到100%成功率，$l_2$距离仅0.89
- 无需额外模块，适合研究隐蔽攻击的学者
不可察觉的对抗攻击近年来受到广泛关注。现有方法通常在攻击过程中引入外部模块或额外损失项以实现不可察觉性，而我们认为此类设计可能并非必要。本文从优化角度重新思考不可察觉攻击的本质，提出两种简单但有效的策略，充分释放经典PGD攻击在不可察觉性方面的潜力。具体而言，动态步长策略旨在以最小攻击代价逼近目标模型的决策边界，自适应早停策略则将对抗扰动的冗余强度降至最低。所提出的PGD-Imperceptible（PGD-Imp）攻击在无目标与有目标场景下均达到当前最优性能。对ResNet-50进行无目标攻击时，PGD-Imp实现100%（+0.3%）攻击成功率、0.89（-1.76）$l_2$距离、52.93（+9.2）PSNR，且运行时间仅57秒（-371秒），显著优于现有方法。
原文摘要 · Abstract (English)
Imperceptible adversarial attacks have recently attracted increasing research interests. Existing methods typically incorporate external modules or loss terms other than a simple $l_p$-norm into the attack process to achieve imperceptibility, while we argue that such additional designs may not be necessary. In this paper, we rethink the essence of imperceptible attacks and propose two simple yet effective strategies to unleash the potential of PGD, the common and classical attack, for imperceptibility from an optimization perspective. Specifically, the Dynamic Step Size is introduced to find the optimal solution with minimal attack cost towards the decision boundary of the attacked model, and the Adaptive Early Stop strategy is adopted to reduce the redundant strength of adversarial perturbations to the minimum level. The proposed PGD-Imperceptible (PGD-Imp) attack achieves state-of-the-art results in imperceptible adversarial attacks for both untargeted and targeted scenarios. When performing untargeted attacks against ResNet-50, PGD-Imp attains 100$\%$ (+0.3$\%$) ASR, 0.89 (-1.76) $l_2$ distance, and 52.93 (+9.2) PSNR with 57s (-371s) running time, significantly outperforming existing methods.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。