通过逆知识蒸馏提升对抗样本跨模型迁移能力。
Improving the Transferability of Adversarial Examples by Inverse Knowledge Distillation
- 设计逆知识蒸馏损失，增强攻击梯度多样性。
- 在ImageNet上使对抗样本迁移成功率显著提升。
- 适合黑盒攻击场景下提升攻击通用性。
近年来，深度神经网络的快速发展引发了对其安全性和鲁棒性的关注。尽管现有对抗攻击算法在提升对抗样本迁移性方面取得进展，但因未充分考虑目标与源模型间的差异，性能仍不理想。为此，我们提出一种新方法——逆知识蒸馏（Inverse Knowledge Distillation, IKD），旨在有效提升对抗样本的迁移能力。IKD引入受知识蒸馏启发的损失函数，可无缝集成至基于梯度的攻击方法中，促进攻击梯度的多样性，缓解对特定模型架构的过拟合。通过梯度多样化，IKD生成的对抗样本在不同模型间具有更强的泛化能力，显著提升黑盒攻击场景下的有效性。在ImageNet数据集上的大量实验验证了该方法的有效性，证明其在多种模型上均显著提升了对抗样本的迁移性与攻击成功率。
原文摘要 · Abstract (English)
In recent years, the rapid development of deep neural networks has brought increased attention to the security and robustness of these models. While existing adversarial attack algorithms have demonstrated success in improving adversarial transferability, their performance remains suboptimal due to a lack of consideration for the discrepancies between target and source models. To address this limitation, we propose a novel method, Inverse Knowledge Distillation (IKD), designed to enhance adversarial transferability effectively. IKD introduces a distillation-inspired loss function that seamlessly integrates with gradient-based attack methods, promoting diversity in attack gradients and mitigating overfitting to specific model architectures. By diversifying gradients, IKD enables the generation of adversarial samples with superior generalization capabilities across different models, significantly enhancing their effectiveness in black-box attack scenarios. Extensive experiments on the ImageNet dataset validate the effectiveness of our approach, demonstrating substantial improvements in the transferability and attack success rates of adversarial samples across a wide range of models.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。