arXiv:2509.00826cs.CVcs.AI2025-09

通过分阶段优化,更高效地生成强对抗样本。

Sequential Difference Maximization: Generating Adversarial Examples via Multi-Stage Optimization

  • 分三阶段优化:先压缩解空间,再逐步提升非正确类概率上界。
  • 在多个数据集上优于当前最优方法,攻击效率更高。
  • 适合研究模型鲁棒性或对抗训练的开发者使用。

高效的对抗攻击方法对评估计算机视觉模型的鲁棒性至关重要。本文将生成对抗样本的优化目标重构为‘最大化非真实标签概率上界与真实标签概率之差’,提出一种基于梯度的攻击方法——顺序差异最大化(SDM)。SDM构建了‘循环-阶段-步骤’三层优化框架,循环与步骤间过程一致,但各阶段损失函数不同:初始阶段使用真实标签负概率压缩解空间;后续阶段引入方向概率差异比(DPDR)损失,通过压缩无关标签概率,逐步提升非真实标签的概率上界。实验表明,相较于现有最优方法,SDM不仅攻击性能更强,且具备更高的攻击成本效益。此外,SDM可与对抗训练结合,增强防御效果。代码已公开于 https://github.com/X-L-Liu/SDM。

原文摘要 · Abstract (English)

Efficient adversarial attack methods are critical for assessing the robustness of computer vision models. In this paper, we reconstruct the optimization objective for generating adversarial examples as "maximizing the difference between the non-true labels' probability upper bound and the true label's probability," and propose a gradient-based attack method termed Sequential Difference Maximization (SDM). SDM establishes a three-layer optimization framework of "cycle-stage-step." The processes between cycles and between iterative steps are respectively identical, while optimization stages differ in terms of loss functions: in the initial stage, the negative probability of the true label is used as the loss function to compress the solution space; in subsequent stages, we introduce the Directional Probability Difference Ratio (DPDR) loss function to gradually increase the non-true labels' probability upper bound by compressing the irrelevant labels' probabilities. Experiments demonstrate that compared with previous SOTA methods, SDM not only exhibits stronger attack performance but also achieves higher attack cost-effectiveness. Additionally, SDM can be combined with adversarial training methods to enhance their defensive effects. The code is available at https://github.com/X-L-Liu/SDM.

对抗攻击优化框架模型鲁棒性

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。