用联合注意力蒸馏生成跨架构对抗样本,高效且通用。
Latent Danger Zone: Distilling Unified Attention for Cross-Architecture Black-box Attacks
- 从CNN和ViT中蒸馏注意力图,指导扩散模型生成对抗扰动。
- 在多个模型间实现高迁移性,攻击成功率显著提升。
- 无需大量查询,适合资源受限的黑盒攻击场景。
黑盒对抗攻击因难以访问模型内部结构而面临挑战。现有方法常依赖特定网络架构或需大量查询,导致跨架构迁移能力弱且查询成本高。为此,我们提出JAD——一种基于潜在扩散模型的黑盒对抗攻击框架。JAD通过融合卷积神经网络(CNN)与视觉变换器(ViT)的注意力图,指导潜在扩散模型生成对抗样本。该方法聚焦于跨架构共同敏感的图像区域,从而构建可有效迁移至不同模型类型的对抗扰动。联合注意力蒸馏策略使JAD具备架构无关性,在多种模型上实现更优的攻击泛化性能。此外,扩散框架的生成特性降低了对迭代查询的依赖,显著提升样本生成效率。实验表明,相比现有方法,JAD在攻击泛化性、生成效率及跨架构迁移能力方面均有明显优势,为黑盒对抗攻击提供了一种高效可行的新范式。
原文摘要 · Abstract (English)
Black-box adversarial attacks remain challenging due to limited access to model internals. Existing methods often depend on specific network architectures or require numerous queries, resulting in limited cross-architecture transferability and high query costs. To address these limitations, we propose JAD, a latent diffusion model framework for black-box adversarial attacks. JAD generates adversarial examples by leveraging a latent diffusion model guided by attention maps distilled from both a convolutional neural network (CNN) and a Vision Transformer (ViT) models. By focusing on image regions that are commonly sensitive across architectures, this approach crafts adversarial perturbations that transfer effectively between different model types. This joint attention distillation strategy enables JAD to be architecture-agnostic, achieving superior attack generalization across diverse models. Moreover, the generative nature of the diffusion framework yields high adversarial sample generation efficiency by reducing reliance on iterative queries. Experiments demonstrate that JAD offers improved attack generalization, generation efficiency, and cross-architecture transferability compared to existing methods, providing a promising and effective paradigm for black-box adversarial attacks.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。