用扩散模型生成假图，黑盒模型被低成本攻破
Explore the vulnerability of black-box models via diffusion models
- 用扩散模型生成高质假图训练替代模型
- 仅用1%查询量实现98.68%攻击成功率
- 适合研究模型安全与对抗攻击的学者
扩散模型在图像生成中表现卓越，但也带来版权侵权、隐私泄露和有害内容生成等安全风险。本文发现一种新型威胁：攻击者利用扩散模型API生成合成图像，用于训练高性能替代模型，从而对黑盒分类模型实施模型提取和迁移式对抗攻击，仅需极少查询即可完成。生成图像分辨率高、多样性足，使替代模型输出与目标模型高度一致。在包括CIFAR和ImageNet子集在内的七个基准上，该方法平均性能比现有最优方法提升27.37%，查询量仅为后者的0.01倍，对抗攻击成功率高达98.68%。
原文摘要 · Abstract (English)
Recent advancements in diffusion models have enabled high-fidelity and photorealistic image generation across diverse applications. However, these models also present security and privacy risks, including copyright violations, sensitive information leakage, and the creation of harmful or offensive content that could be exploited maliciously. In this study, we uncover a novel security threat where an attacker leverages diffusion model APIs to generate synthetic images, which are then used to train a high-performing substitute model. This enables the attacker to execute model extraction and transfer-based adversarial attacks on black-box classification models with minimal queries, without needing access to the original training data. The generated images are sufficiently high-resolution and diverse to train a substitute model whose outputs closely match those of the target model. Across the seven benchmarks, including CIFAR and ImageNet subsets, our method shows an average improvement of 27.37% over state-of-the-art methods while using just 0.01 times of the query budget, achieving a 98.68% success rate in adversarial attacks on the target model.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。