用影响度引导路径探索，提升Transformer模型的对抗样本发现效率
Influence-Guided Concolic Testing of Transformer Robustness
- 基于SHAP值排序路径条件，优先探索对预测影响大的分支
- 在500组测试中成功率达60%，显著高于黑盒基线的15%
- 适用于研究Transformer鲁棒性的研究人员或安全评估者
神经网络的符号执行测试通过交替进行具体执行与约束求解来搜索导致模型决策变化的输入。本文提出一种针对Transformer分类器的符号执行测试方法，利用SHAP估计对待决路径谓词按其对当前预测的影响程度进行排序。为支持自注意力机制中的多头结构并结合SMT求解执行，我们在纯Python中实现了兼容求解器的注意力语义，并通过具体化指数参数显式表示softmax边界。在CIFAR-10数据集上，针对三种紧凑型Transformer分类器、ResNet18和VGG16，在单像素预算和900秒时间限制下进行评估。在500组匹配测试中，本方法成功率达60%，远超将模型视为黑箱的差分进化基线（15%）。在主实验的两层Transformer分支顺序研究中，基于SHAP的谓词优先级策略使成功率从56%提升至60%，攻击中位时间减少51%。结果表明，影响度引导的路径探索可使符号执行成为发现Transformer模型对抗样本的实用方法。
原文摘要 · Abstract (English)
Concolic testing for neural networks alternates concrete execution with constraint solving to search for inputs that flip model decisions. We present a concolic tester for Transformer classifiers that uses SHAP estimates to rank pending path predicates by their impact on the current prediction. To support self-attention with multiple heads in execution backed by SMT solving, we implement attention semantics in pure Python that are compatible with the solver and make the softmax boundary explicit by concretizing exponentiation arguments. We evaluate our method on CIFAR-10 across three compact Transformer classifiers, ResNet18, and VGG16 under a one-pixel budget and a 900s horizon. Across the 500 model--input pairs in this matched comparison, our method achieves 60% success, compared with 15% for a differential evolution baseline that treats the model as a black box. In the primary two-layer Transformer branch-ordering study, SHAP-based predicate prioritization raises success from 56% to 60% and reduces median attack time by 51%. These results show that influence-guided path exploration can make concolic testing a practical way to find adversarial examples in Transformer models.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。