通过平均微调轨迹提升对抗样本目标迁移性
Two Heads Are Better Than One: Averaging along Fine-Tuning to Improve Targeted Transferability
- 在特征空间微调时，对整个优化路径取平均而非仅用终点
- 显著提升对抗样本在不同模型间的迁移成功率，尤其在强攻击场景下
- 适合研究对抗攻击与防御的从业者，特别是关注迁移性的方向
尽管针对性攻击的优化时间远长于非针对性攻击，其迁移性仍不理想。近期研究表明，在特征空间中微调现有对抗样本（AE）可有效提升其针对性迁移性。然而，现有微调方法仅利用最终结果，忽略了微调路径中的宝贵信息。我们发现原始微调路径倾向于在损失曲面平坦区域的外围振荡，因此提出对微调轨迹进行平均，将生成的对抗样本拉向更中心的位置。我们在多种攻击场景下，将该方法与当前最先进的针对性攻击结合，与现有微调方案进行对比。实验结果验证了所提方法在提升针对性迁移性方面的优越性。代码已开源：github.com/zengh5/Avg_FT。
原文摘要 · Abstract (English)
With much longer optimization time than that of untargeted attacks notwithstanding, the transferability of targeted attacks is still far from satisfactory. Recent studies reveal that fine-tuning an existing adversarial example (AE) in feature space can efficiently boost its targeted transferability. However, existing fine-tuning schemes only utilize the endpoint and ignore the valuable information in the fine-tuning trajectory. Noting that the vanilla fine-tuning trajectory tends to oscillate around the periphery of a flat region of the loss surface, we propose averaging over the fine-tuning trajectory to pull the crafted AE towards a more centered region. We compare the proposed method with existing fine-tuning schemes by integrating them with state-of-the-art targeted attacks in various attacking scenarios. Experimental results uphold the superiority of the proposed method in boosting targeted transferability. The code is available at github.com/zengh5/Avg_FT.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。