通过随机剪枝参数提升攻击迁移性,显著提高目标攻击成功率。
RaPA: Enhancing Transferable Targeted Attacks via Random Parameter Pruning
- 在攻击过程中随机剪枝模型参数,生成语义一致的多样化替代模型。
- 跨架构迁移时平均攻击成功率提升11.7%,达33.3%(比最优基线高)。
- 无需训练、兼容现有框架,适合快速部署于各类对抗攻击场景。
相较于无目标攻击,基于迁移的目标攻击仍面临较低的攻击成功率(ASR)。尽管已有方法如输入多样性、梯度稳定和重训练替代模型取得进展,但现有生成的对抗样本仍过度依赖少数替代模型参数,限制其迁移性。本文发现此问题根源,并提出随机参数剪枝攻击(RaPA),在优化过程中引入参数级随机化:每一步随机剪枝模型参数以生成多样且语义一致的替代变体。我们证明该操作等价于添加重要性均衡正则项,缓解了参数依赖过强的问题。在CNN与Transformer架构上的大量实验表明,RaPA显著提升迁移能力。在从CNN到Transformer的挑战性迁移场景中,平均ASR比现有最佳方法高出11.7%(达33.3%),且为训练无关、跨架构高效,可轻松集成至现有攻击框架。代码已开源。
原文摘要 · Abstract (English)
Compared to untargeted attacks, targeted transfer-based attack is still suffering from much lower Attack Success Rates (ASRs), although significant improvements have been achieved by kinds of methods, such as diversifying input, stabilizing the gradient, and re-training surrogate models. In this paper, we find that adversarial examples generated by existing methods rely heavily on a small subset of surrogate model parameters, which in turn limits their transferability to unseen target models. Inspired by this, we propose the Random Parameter Pruning Attack (RaPA), which introduces parameter-level randomization during the attack process. At each optimization step, RaPA randomly prunes model parameters to generate diverse yet semantically consistent surrogate variants.We show this parameter-level randomization is equivalent to adding an importance-equalization regularizer, thereby alleviating the over-reliance issue. Extensive experiments across both CNN and Transformer architectures demonstrate that RaPA substantially enhances transferability. In the challenging case of transferring from CNN-based to Transformer-based models, RaPA achieves up to 11.7% higher average ASRs than state-of-the-art baselines(with 33.3% ASRs), while being training-free, cross-architecture efficient, and easily integrated into existing attack frameworks. Code is available in https://github.com/molarsu/RaPA.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。