提出新方法生成更易跨模型攻击的对抗样本,提升分割模型安全性评估能力。
SegTrans: Transferable Adversarial Examples for Segmentation Models
- 将输入分块并重映射局部语义信息生成增强样本用于优化扰动
- 在PASCAL VOC和Cityscapes上平均提升8.55%的迁移成功率
- 无需额外计算开销,适合研究模型鲁棒性或防御策略的开发者
分割模型在白盒环境下对对抗样本高度敏感,但现有攻击方法跨模型迁移能力差。由于分割模型中复杂的上下文依赖及源模型与目标模型间特征分布差异,导致迁移成功率不理想。为此,我们提出SegTrans,一种新型迁移攻击框架:将输入样本划分为多个局部区域,重映射其语义信息生成多样化的增强样本,替代原样本进行扰动优化,从而提升对抗样本在不同分割模型间的迁移能力。与现有方法不同,SegTrans仅保留原始输入的局部语义信息进行扰动优化,而非使用全局语义。在两个基准数据集PASCAL VOC和Cityscapes、四种分割模型及三种主干网络上的大量实验表明,SegTrans显著提升了对抗迁移成功率,且未引入额外计算开销。相比当前最先进方法,平均提升8.55%的迁移攻击成功率,并提升超过100%的计算效率。
原文摘要 · Abstract (English)
Segmentation models exhibit significant vulnerability to adversarial examples in white-box settings, but existing adversarial attack methods often show poor transferability across different segmentation models. While some researchers have explored transfer-based adversarial attack (i.e., transfer attack) methods for segmentation models, the complex contextual dependencies within these models and the feature distribution gaps between surrogate and target models result in unsatisfactory transfer success rates. To address these issues, we propose SegTrans, a novel transfer attack framework that divides the input sample into multiple local regions and remaps their semantic information to generate diverse enhanced samples. These enhanced samples replace the original ones for perturbation optimization, thereby improving the transferability of adversarial examples across different segmentation models. Unlike existing methods, SegTrans only retains local semantic information from the original input, rather than using global semantic information to optimize perturbations. Extensive experiments on two benchmark datasets, PASCAL VOC and Cityscapes, four different segmentation models, and three backbone networks show that SegTrans significantly improves adversarial transfer success rates without introducing additional computational overhead. Compared to the current state-of-the-art methods, SegTrans achieves an average increase of 8.55% in transfer attack success rate and improves computational efficiency by more than 100%.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。