通过多尺度变换提升对抗样本迁移性，有效突破防御模型
Boosting Adversarial Transferability Against Defenses via Multi-Scale Transformation
- 构建分段高斯金字塔，生成多尺度对抗样本
- 在黑盒防御模型上平均攻击成功率提升2.3%至32.6%
- 方法通用性强，可无缝集成到多数现有攻击中
对抗样本的迁移性对深度神经网络构成重大安全威胁，攻击者无需了解目标模型即可实施攻击。本文提出一种新的分段高斯金字塔（SGP）攻击方法，以增强对抗样本的迁移能力，尤其针对防御模型。与以往聚焦单一尺度图像的方法不同，该方法利用高斯滤波和三种下采样方式构建一系列多尺度样本，计算每个尺度下损失函数的梯度，并取其平均值生成对抗扰动。SGP可视为一种高可扩展性的输入变换，易于融入大多数现有对抗攻击中。大量实验表明，相较于当前最优方法，SGP在黑盒防御模型上的平均攻击成功率提升了2.3%至32.6%，仅基于迁移性表现。
原文摘要 · Abstract (English)
The transferability of adversarial examples poses a significant security challenge for deep neural networks, which can be attacked without knowing anything about them. In this paper, we propose a new Segmented Gaussian Pyramid (SGP) attack method to enhance the transferability, particularly against defense models. Unlike existing methods that generally focus on single-scale images, our approach employs Gaussian filtering and three types of downsampling to construct a series of multi-scale examples. Then, the gradients of the loss function with respect to each scale are computed, and their average is used to determine the adversarial perturbations. The proposed SGP can be considered an input transformation with high extensibility that is easily integrated into most existing adversarial attacks. Extensive experiments demonstrate that in contrast to the state-of-the-art methods, SGP significantly enhances attack success rates against black-box defense models, with average attack success rates increasing by 2.3% to 32.6%, based only on transferability.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。