通过局部全局联合攻击，显著提升对抗样本的定向迁移能力。
Everywhere Attack: Attacking Locally and Globally to Boost Targeted Transferability
- 将图像分块后对每个区域同时进行定向攻击
- 在ImageNet上使现有攻击迁移率提升28.8%至300%
- 适用于各类攻击方法，适合安全评估与防御研究
对抗样本的迁移性指在一台代理模型上生成的对抗样本能攻击其他模型。尽管无目标迁移性已取得显著进展，但有目标迁移性仍具挑战。本文提出一种‘处处攻击’方案以增强有目标迁移性：同时从全局和局部攻击目标图像。我们不再只优化图像中高置信度的目标类别，而是针对每个局部图像区域优化‘一组目标’。具体地，将目标图像划分为非重叠块，并联合对每块执行定向攻击。该策略缓解了代理模型与目标模型间注意力不一致导致的迁移失败问题，从而实现更强的迁移性。本方法具有方法无关性，可轻松集成现有可迁移攻击以获得更高迁移性。在ImageNet上的大量实验表明，所提方法普遍提升了当前最优有目标攻击性能，例如广泛采用的Logit攻击迁移率提升28.8%至300%。我们还在真实平台Google Cloud Vision上验证了生成的对抗样本，结果进一步证实该方法的优势。
原文摘要 · Abstract (English)
Adversarial examples' (AE) transferability refers to the phenomenon that AEs crafted with one surrogate model can also fool other models. Notwithstanding remarkable progress in untargeted transferability, its targeted counterpart remains challenging. This paper proposes an everywhere scheme to boost targeted transferability. Our idea is to attack a victim image both globally and locally. We aim to optimize 'an army of targets' in every local image region instead of the previous works that optimize a high-confidence target in the image. Specifically, we split a victim image into non-overlap blocks and jointly mount a targeted attack on each block. Such a strategy mitigates transfer failures caused by attention inconsistency between surrogate and victim models and thus results in stronger transferability. Our approach is method-agnostic, which means it can be easily combined with existing transferable attacks for even higher transferability. Extensive experiments on ImageNet demonstrate that the proposed approach universally improves the state-of-the-art targeted attacks by a clear margin, e.g., the transferability of the widely adopted Logit attack can be improved by 28.8%-300%.We also evaluate the crafted AEs on a real-world platform: Google Cloud Vision. Results further support the superiority of the proposed method.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。