提出新方法揭露自编码器隐藏漏洞,提升对抗攻击可靠性。
Revealing Hidden Vulnerabilities in Autoencoders through Gradient Signal Restoration
- 通过恢复病态层梯度信号,改进对抗攻击优化过程。
- 在多种架构和攻击场景下,攻击效果显著提升,暴露原方法低估的漏洞。
- 适用于自编码器及多模态编码器-解码器,帮助评估真实鲁棒性。
深度自编码器(AE)的对抗鲁棒性研究远不如判别模型充分,尽管其压缩的潜在表示会导致病态映射,放大微小输入扰动并破坏重建。现有白盒攻击通过优化范数有界的扰动以最大化重建损失,常收敛于次优解,可能高估了AE的鲁棒性。我们发现此问题源于反向传播中病态层的对抗损失梯度消失,与中间权重矩阵近零奇异值相关。为此,我们提出GRILL(病态层梯度信号恢复),旨在缓解梯度退化,提升编码器-解码器架构对抗鲁棒性评估的可靠性。GRILL在优化过程中抑制对抗梯度衰减,使攻击更接近固定范数约束下的高失真扰动。在多种AE架构、样本特定与通用攻击、标准与自适应设置下,实验表明GRILL显著提升攻击有效性,揭示了原有攻击方法掩盖的漏洞。此外,初步证据显示现代多模态编码器-解码器也存在类似脆弱性。
原文摘要 · Abstract (English)
Adversarial robustness of deep autoencoders (AEs) has received less attention than that of discriminative models, although their compressed latent representations induce ill-conditioned mappings that can amplify small input perturbations and destabilize reconstructions. Existing white-box attacks for AEs, which optimize norm-bounded adversarial perturbations to maximize reconstruction damage, often converge to suboptimal perturbations, thereby potentially overstating AE robustness. We show that this limitation is linked to vanishing adversarial loss gradients during backpropagation through ill-conditioned layers, associated with near-zero singular values in their intermediate weight matrices. To address this, we propose GRILL (Gradient Signal Restoration in Ill-Conditioned Layers), a framework designed to mitigate gradient degradation and improve the reliability of adversarial robustness evaluation in encoder-decoder architectures. GRILL is designed to mitigate adversarial gradient degradation during optimization, enabling attacks to better approximate high-distortion perturbations under fixed norm constraints. Through extensive experiments across multiple AE architectures, under both sample-specific and universal attacks, as well as standard and adaptive attack settings, we show that GRILL significantly increases attack effectiveness, thereby exposing vulnerabilities hidden by existing attack limitations. Beyond AEs, we provide preliminary evidence that modern multimodal encoder-decoder architectures exhibit similar vulnerabilities.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。