arXiv:2502.07821cs.CVcs.AI2025-02NeurIPS被引 1

用强化学习让像素攻击更精准,减少随机性并提升成功率。

Amnesia as a Catalyst for Enhancing Black Box Pixel Attacks in Image Classification and Object Detection

  • 通过记忆与遗忘机制,用强化学习优化像素扰动
  • 在ImageNet上优于现有像素攻击,检测任务中减少更多目标置信度
  • 首次将查询式像素攻击拓展至目标检测,且查询次数更少

已知基于查询的攻击在对抗性黑盒攻击中成功率较高。然而,针对仅影响少量像素的像素攻击研究较少,尤其在图像分类中多依赖随机补丁,忽视了分散像素更适合攻击的事实。目前尚无基于查询的像素攻击应用于目标检测。为此,我们提出一种新型像素级黑盒攻击RFPAR,利用强化学习实现记忆与遗忘过程,通过单步强化学习生成奖励,减少随机性并摆脱对补丁的依赖。RFPAR能在有限像素约束下有效降低模型置信度。实验表明,在ImageNet-1K上,RFPAR优于当前最优查询式像素攻击;在MSCOCO数据集上,使用YOLOv8和DDQ时,其达到相当的mAP下降效果但查询次数更少。进一步在Argoverse数据集上验证,RFPAR可在更大规模场景中有效移除目标。代码已开源。

原文摘要 · Abstract (English)

It is well known that query-based attacks tend to have relatively higher success rates in adversarial black-box attacks. While research on black-box attacks is actively being conducted, relatively few studies have focused on pixel attacks that target only a limited number of pixels. In image classification, query-based pixel attacks often rely on patches, which heavily depend on randomness and neglect the fact that scattered pixels are more suitable for adversarial attacks. Moreover, to the best of our knowledge, query-based pixel attacks have not been explored in the field of object detection. To address these issues, we propose a novel pixel-based black-box attack called Remember and Forget Pixel Attack using Reinforcement Learning(RFPAR), consisting of two main components: the Remember and Forget processes. RFPAR mitigates randomness and avoids patch dependency by leveraging rewards generated through a one-step RL algorithm to perturb pixels. RFPAR effectively creates perturbed images that minimize the confidence scores while adhering to limited pixel constraints. Furthermore, we advance our proposed attack beyond image classification to object detection, where RFPAR reduces the confidence scores of detected objects to avoid detection. Experiments on the ImageNet-1K dataset for classification show that RFPAR outperformed state-of-the-art query-based pixel attacks. For object detection, using the MSCOCO dataset with YOLOv8 and DDQ, RFPAR demonstrates comparable mAP reduction to state-of-the-art query-based attack while requiring fewer query. Further experiments on the Argoverse dataset using YOLOv8 confirm that RFPAR effectively removed objects on a larger scale dataset. Our code is available at https://github.com/KAU-QuantumAILab/RFPAR.

对抗攻击像素攻击强化学习目标检测

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。