改进积分梯度路径，生成更强迁移性对抗样本
Improving Integrated Gradient-based Transferable Adversarial Examples by Refining the Integration Path
- 通过优化积分路径的多重性、单调性和多样性提升攻击效果
- 在多种模型和防御下，相比最新方法提升37.3%攻击成功率
- 适合研究对抗攻击与模型鲁棒性的研究人员参考
可迁移的对抗样本在实际黑盒攻击中构成威胁。利用积分梯度（IG）提升迁移性是一种有效方法，但现有方法因直接套用原始解释性技术而表现受限。本文聚焦于IG的积分路径，从多重性、单调性和多样性三方面进行理论分析与优化，提出多路单调多样化积分梯度（MuMoDIG）攻击。该方法在不同CNN与ViT模型及防御机制下均能生成高迁移性对抗样本。实验表明，MuMoDIG相比最新IG基攻击最高提升37.3%，优于其他顶尖攻击达8.4%。研究揭示：将成熟技术迁移用于提升迁移性需非平凡调整。代码已开源。
原文摘要 · Abstract (English)
Transferable adversarial examples are known to cause threats in practical, black-box attack scenarios. A notable approach to improving transferability is using integrated gradients (IG), originally developed for model interpretability. In this paper, we find that existing IG-based attacks have limited transferability due to their naive adoption of IG in model interpretability. To address this limitation, we focus on the IG integration path and refine it in three aspects: multiplicity, monotonicity, and diversity, supported by theoretical analyses. We propose the Multiple Monotonic Diversified Integrated Gradients (MuMoDIG) attack, which can generate highly transferable adversarial examples on different CNN and ViT models and defenses. Experiments validate that MuMoDIG outperforms the latest IG-based attack by up to 37.3\% and other state-of-the-art attacks by 8.4\%. In general, our study reveals that migrating established techniques to improve transferability may require non-trivial efforts. Code is available at \url{https://github.com/RYC-98/MuMoDIG}.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。