通过中间特征设计新攻击，提升分割模型黑盒攻击的迁移能力。
FSPGD: Rethinking Black-box Attacks on Semantic Segmentation
- 从中间层特征计算梯度，而非输出预测。
- 在Pascal VOC和Cityscapes上实现新最优迁移性能。
- 适合研究对抗攻击与模型鲁棒性的学者参考。
迁移性，即为某一模型生成的对抗样本能欺骗其他模型的能力，对黑盒攻击至关重要。尽管语义分割攻击方法不断进步，但迁移性依然受限，影响其在真实场景中的有效性。为此，我们提出特征相似性投影梯度下降（FSPGD）攻击，一种新型黑盒攻击方法，可同时提升攻击效果与迁移性。不同于传统分割攻击依赖输出预测计算梯度，FSPGD从中间层特征中获取梯度。具体而言，该方法设计了一种损失函数，通过比较干净图像与对抗样本的特征来聚焦局部信息，同时通过考虑物体间的空间关系来破坏上下文信息。在Pascal VOC 2012和Cityscapes数据集上的实验表明，FSPGD在迁移性和攻击性能上均取得显著提升，确立了新的基准。代码已开源：https://github.com/KU-AIVS/FSPGD。
原文摘要 · Abstract (English)
Transferability, the ability of adversarial examples crafted for one model to deceive other models, is crucial for black-box attacks. Despite advancements in attack methods for semantic segmentation, transferability remains limited, reducing their effectiveness in real-world applications. To address this, we introduce the Feature Similarity Projected Gradient Descent (FSPGD) attack, a novel black-box approach that enhances both attack performance and transferability. Unlike conventional segmentation attacks that rely on output predictions for gradient calculation, FSPGD computes gradients from intermediate layer features. Specifically, our method introduces a loss function that targets local information by comparing features between clean images and adversarial examples, while also disrupting contextual information by accounting for spatial relationships between objects. Experiments on Pascal VOC 2012 and Cityscapes datasets demonstrate that FSPGD achieves superior transferability and attack performance, establishing a new state-of-the-art benchmark. Code is available at https://github.com/KU-AIVS/FSPGD.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。