提出可对抗多分类器与变视角的投影攻击方法,提升攻击效果与隐蔽性。
CAPAA: Classifier-Agnostic Projector-Based Adversarial Attack

- 设计无特定分类器依赖的对抗损失,融合多分类器梯度优化
- 在高激活区域集中扰动,提升不同相机角度下的攻击成功率
- 适合研究对抗攻击鲁棒性或隐私保护的开发者参考
基于投影的对抗攻击旨在向场景投射精心设计的光图案(即对抗投影)以欺骗深度图像分类器,具有隐私保护和提升分类器鲁棒性的潜在应用。然而,现有方法主要针对单一分类器和固定相机姿态,忽视了多分类器系统及相机姿态变化的复杂性,导致引入新分类器或新视角时效果下降。本文提出无分类器依赖的投影式对抗攻击方法(CAPAA)。首先,构建一种新型的分类器无关对抗损失与优化框架,聚合多个分类器的对抗性与隐蔽性损失梯度;其次,提出基于注意力的梯度加权机制,将扰动集中在高分类激活区域,从而增强对抗投影在不同相机姿态下的鲁棒性。大量实验表明,相比现有基线方法,CAPAA在攻击成功率和隐蔽性方面均有显著提升。代码已公开于:https://github.com/ZhanLiQxQ/CAPAA。
原文摘要 · Abstract (English)
Projector-based adversarial attack aims to project carefully designed light patterns (i.e., adversarial projections) onto scenes to deceive deep image classifiers. It has potential applications in privacy protection and the development of more robust classifiers. However, existing approaches primarily focus on individual classifiers and fixed camera poses, often neglecting the complexities of multi-classifier systems and scenarios with varying camera poses. This limitation reduces their effectiveness when introducing new classifiers or camera poses. In this paper, we introduce Classifier-Agnostic Projector-Based Adversarial Attack (CAPAA) to address these issues. First, we develop a novel classifier-agnostic adversarial loss and optimization framework that aggregates adversarial and stealthiness loss gradients from multiple classifiers. Then, we propose an attention-based gradient weighting mechanism that concentrates perturbations on regions of high classification activation, thereby improving the robustness of adversarial projections when applied to scenes with varying camera poses. Our extensive experimental evaluations demonstrate that CAPAA achieves both a higher attack success rate and greater stealthiness compared to existing baselines. Codes are available at: https://github.com/ZhanLiQxQ/CAPAA.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。