通过优化共享特征梯度,显著提升ViT模型的对抗样本迁移能力。
Boosting Adversarial Transferability via Commonality-Oriented Gradient Optimization
- 聚焦共享特征,增强中低频梯度扰动,抑制个体差异影响。
- 在多个黑盒攻击场景下,迁移成功率超越现有最优方法。
- 适用于研究ViT鲁棒性或提升对抗攻击效果的研究者。
探索高效且可迁移的对抗样本对理解视觉变换器(ViTs)的特性与机制至关重要。然而,基于替代模型生成的对抗样本在黑盒设置中常因过拟合导致迁移能力弱。现有方法通过多样化输入扰动或在替代模型内应用统一梯度正则化来提升迁移性,但未充分挖掘同一任务下替代模型共享与独特特征的潜力,导致迁移性能不佳。因此,增强共享信息的扰动并抑制与个体特征相关的扰动,是提升迁移性的有效途径。为此,我们提出一种面向共性的梯度优化策略(COGO),包含两个组件:共性增强(CE)和个体性抑制(IS)。CE针对中低频区域进行扰动,利用ViTs在相同数据集上训练时更依赖中低频信息进行分类的特点;IS采用自适应阈值评估反向传播梯度与模型个体性的相关性,并相应分配权重。大量实验表明,COGO显著提升了对抗攻击的迁移成功率,优于当前最先进的方法。
原文摘要 · Abstract (English)
Exploring effective and transferable adversarial examples is vital for understanding the characteristics and mechanisms of Vision Transformers (ViTs). However, adversarial examples generated from surrogate models often exhibit weak transferability in black-box settings due to overfitting. Existing methods improve transferability by diversifying perturbation inputs or applying uniform gradient regularization within surrogate models, yet they have not fully leveraged the shared and unique features of surrogate models trained on the same task, leading to suboptimal transfer performance. Therefore, enhancing perturbations of common information shared by surrogate models and suppressing those tied to individual characteristics offers an effective way to improve transferability. Accordingly, we propose a commonality-oriented gradient optimization strategy (COGO) consisting of two components: Commonality Enhancement (CE) and Individuality Suppression (IS). CE perturbs the mid-to-low frequency regions, leveraging the fact that ViTs trained on the same dataset tend to rely more on mid-to-low frequency information for classification. IS employs adaptive thresholds to evaluate the correlation between backpropagated gradients and model individuality, assigning weights to gradients accordingly. Extensive experiments demonstrate that COGO significantly improves the transfer success rates of adversarial attacks, outperforming current state-of-the-art methods.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。