通过精准攻击神经元提升对抗样本跨模型迁移能力
NAT: Learning to Attack Neurons for Enhanced Adversarial Transferability
- 聚焦单个神经元而非整体特征层，实现更精准干扰
- 在41个ImageNet模型上跨模型攻击成功率超基线14%以上
- 仅需10次查询即可达成高攻击成功率，适合高效攻防研究
生成可迁移的对抗扰动通常依赖于训练生成器以最大化源模型单个中间层中干净图像与对抗图像之间的嵌入差异。本文提出神经元迁移攻击（NAT），旨在针对嵌入层中的特定神经元进行攻击。我们发现，以往基于层级别的优化常过度关注少数表达相似概念的神经元，导致层内其他神经元影响微弱。NAT将焦点从嵌入级分离转向更基础的神经元级攻击。实验表明，精准干扰核心神经元能有效破坏神经网络基本单元，为不同模型间的迁移提供共同基础。在41个多样化的ImageNet模型和9个细粒度分类模型上，NAT在跨模型设置下骗过率超过现有基线14%以上，在跨域设置下提升4%。此外，利用训练生成器的互补攻击能力，仅需10次查询即达到显著骗过率。
原文摘要 · Abstract (English)
The generation of transferable adversarial perturbations typically involves training a generator to maximize embedding separation between clean and adversarial images at a single mid-layer of a source model. In this work, we build on this approach and introduce Neuron Attack for Transferability (NAT), a method designed to target specific neuron within the embedding. Our approach is motivated by the observation that previous layer-level optimizations often disproportionately focus on a few neurons representing similar concepts, leaving other neurons within the attacked layer minimally affected. NAT shifts the focus from embedding-level separation to a more fundamental, neuron-specific approach. We find that targeting individual neurons effectively disrupts the core units of the neural network, providing a common basis for transferability across different models. Through extensive experiments on 41 diverse ImageNet models and 9 fine-grained models, NAT achieves fooling rates that surpass existing baselines by over 14\% in cross-model and 4\% in cross-domain settings. Furthermore, by leveraging the complementary attacking capabilities of the trained generators, we achieve impressive fooling rates within just 10 queries. Our code is available at: https://krishnakanthnakka.github.io/NAT/
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。