仅用3-20步生成高质量对抗图像,速度比现有方法快10倍。
TAIGen: Training-Free Adversarial Image Generation via Diffusion Models
- 在扩散模型混合阶段注入扰动,跳过全部时间步。
- 对不同颜色通道分别处理,保持图像结构同时提升误分类率。
- 生成速度快、视觉质量高,适合测试防御模型鲁棒性。
生成式对抗攻击常导致图像质量差且计算开销大。尽管扩散模型能生成高质量图像,但传统方法通常需数百次采样步骤。本文提出TAIGen,一种无需训练的黑盒高效对抗图像生成方法。TAIGen仅需3-20步采样即可生成对抗样本。核心发现是:在混合阶段注入扰动即可达到接近全时序处理的攻击效果。我们设计了一种选择性RGB通道策略——对红色通道应用注意力图,绿色与蓝色通道则使用GradCAM引导的扰动,从而在保留图像结构的同时最大化目标模型的误分类概率。实验表明,所有测试数据集上生成图像的PSNR均高于30 dB。在ImageNet上以VGGNet为源模型,对ResNet攻击成功率70.6%,对MNASNet达80.8%,对ShuffleNet高达97.8%。相比现有扩散模型攻击,生成速度提升10倍。该方法获得最低的鲁棒准确率,表明其对抗防御机制最有效,净化能力最弱。
原文摘要 · Abstract (English)
Adversarial attacks from generative models often produce low-quality images and require substantial computational resources. Diffusion models, though capable of high-quality generation, typically need hundreds of sampling steps for adversarial generation. This paper introduces TAIGen, a training-free black-box method for efficient adversarial image generation. TAIGen produces adversarial examples using only 3-20 sampling steps from unconditional diffusion models. Our key finding is that perturbations injected during the mixing step interval achieve comparable attack effectiveness without processing all timesteps. We develop a selective RGB channel strategy that applies attention maps to the red channel while using GradCAM-guided perturbations on green and blue channels. This design preserves image structure while maximizing misclassification in target models. TAIGen maintains visual quality with PSNR above 30 dB across all tested datasets. On ImageNet with VGGNet as source, TAIGen achieves 70.6% success against ResNet, 80.8% against MNASNet, and 97.8% against ShuffleNet. The method generates adversarial examples 10x faster than existing diffusion-based attacks. Our method achieves the lowest robust accuracy, indicating it is the most impactful attack as the defense mechanism is least successful in purifying the images generated by TAIGen.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。