用强化学习训练攻击代理，让攻击更智能高效。
Adversarial Agents: Black-Box Evasion Attacks with Reinforcement Learning
- 将攻击过程建模为马尔可夫决策过程，利用历史经验优化攻击策略。
- 在图像分类任务上，攻击成功率最高提升13.2%，查询次数减少16.9%。
- 相比现有方法，在未见样本上攻击成功率高出17%，适合研究安全防御者。
机器学习模型的攻击已被广泛研究，主要依赖无状态优化。本文展示强化学习（RL）代理如何学习一类新的攻击算法来生成对抗样本。与传统对抗机器学习（AML）方法独立生成对抗样本不同，我们的基于RL的方法保留并利用过往攻击经验，以提升未来攻击的有效性和效率。我们将对抗样本生成建模为马尔可夫决策过程，并评估了RL在（a）学习有效高效的攻击策略和（b）与最先进的AML方法竞争方面的能力。在两个图像分类基准上，我们的代理在训练结束时相较于初始阶段，攻击成功率最高提升13.2%，每次攻击平均查询次数减少16.9%。与最先进的图像攻击方法进行直接对比，本方法在训练后对未见输入的攻击成功率高出17%。从安全角度看，该工作揭示了一种利用强化学习训练攻击代理、实现高效且可扩展攻击的新威胁路径。
原文摘要 · Abstract (English)
Attacks on machine learning models have been extensively studied through stateless optimization. In this paper, we demonstrate how a reinforcement learning (RL) agent can learn a new class of attack algorithms that generate adversarial samples. Unlike traditional adversarial machine learning (AML) methods that craft adversarial samples independently, our RL-based approach retains and exploits past attack experience to improve the effectiveness and efficiency of future attacks. We formulate adversarial sample generation as a Markov Decision Process and evaluate RL's ability to (a) learn effective and efficient attack strategies and (b) compete with state-of-the-art AML. On two image classification benchmarks, our agent increases attack success rate by up to 13.2% and decreases the average number of victim model queries per attack by up to 16.9% from the start to the end of training. In a head-to-head comparison with state-of-the-art image attacks, our approach enables an adversary to generate adversarial samples with 17% more success on unseen inputs post-training. From a security perspective, this work demonstrates a powerful new attack vector that uses RL to train agents that attack ML models efficiently and at scale.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。