arXiv:2509.06459cs.CVcs.LG2025-09中稿 · ECAI 2025

提出两种新型黑盒攻击算法,显著提升对视觉模型的漏洞探测效率。

IGAff: Benchmarking Adversarial Iterative and Genetic Affine Algorithms on Deep Neural Networks

  • 基于仿射变换与遗传算法设计迭代攻击,无需模型内部信息。
  • 在多个数据集上实现最高8.82%的攻击成功率提升。
  • 适用于研究模型鲁棒性或防御机制的科研人员参考。

深度神经网络在人工智能多个领域占据主导地位,虽在众多任务中达到顶尖性能,但其可解释性差且存在意外弱点。对抗攻击研究旨在生成能暴露这些弱点的输入,但在黑盒场景(模型细节不可见)下尤为困难。本文深入评估了两种基于仿射变换和遗传算法的新型黑盒迭代攻击方法:1)仿射变换攻击(ATA),通过随机仿射变换最大化攻击得分函数;2)仿射遗传攻击(AGA),结合随机噪声与仿射变换的遗传算法。我们在ResNet-18、DenseNet-121、Swin Transformer V2和Vision Transformer等架构上,利用Tiny ImageNet、Caltech-256和Food-101数据集进行测试,考察算法参数变化、数据增强及全局与定向攻击配置下的表现。并与Pixle和Square Attack两种黑盒算法对比。实验表明,本方法在图像分类任务中优于现有文献方法,攻击成功率最高提升达8.82%。研究揭示了全局与定向攻击层面成功的防御与攻击策略,并通过参数扰动验证了模型的对抗鲁棒性。

原文摘要 · Abstract (English)

Deep neural networks currently dominate many fields of the artificial intelligence landscape, achieving state-of-the-art results on numerous tasks while remaining hard to understand and exhibiting surprising weaknesses. An active area of research focuses on adversarial attacks, which aim to generate inputs that uncover these weaknesses. However, this proves challenging, especially in the black-box scenario where model details are inaccessible. This paper explores in detail the impact of such adversarial algorithms on ResNet-18, DenseNet-121, Swin Transformer V2, and Vision Transformer network architectures. Leveraging the Tiny ImageNet, Caltech-256, and Food-101 datasets, we benchmark two novel black-box iterative adversarial algorithms based on affine transformations and genetic algorithms: 1) Affine Transformation Attack (ATA), an iterative algorithm maximizing our attack score function using random affine transformations, and 2) Affine Genetic Attack (AGA), a genetic algorithm that involves random noise and affine transformations. We evaluate the performance of the models in the algorithm parameter variation, data augmentation, and global and targeted attack configurations. We also compare our algorithms with two black-box adversarial algorithms, Pixle and Square Attack. Our experiments yield better results on the image classification task than similar methods in the literature, achieving an accuracy improvement of up to 8.82%. We provide noteworthy insights into successful adversarial defenses and attacks at both global and targeted levels, and demonstrate adversarial robustness through algorithm parameter variation.

对抗攻击黑盒攻击遗传算法模型鲁棒性

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。