提出反向对抗样本：与原数据差异大却得相同结果，挑战传统认知。
A New Type of Adversarial Examples
- 反向构造对抗样本：从相反方向扰动输入，使模型仍输出原标签。
- 新算法有效生成反向对抗样本，在图像分类任务中成功率超90%。
- 揭示对抗样本分布广泛，不局限于原数据邻域，影响安全评估。
大多数机器学习模型对对抗样本敏感，引发安全担忧。传统对抗样本通过在原始数据上施加细微但恶意的扰动，导致模型输出错误。本文提出一种完全相反的构造方式：生成与原数据显著不同却仍使模型输出相同的对抗样本。为此，我们提出了新的算法，包括负向迭代快速梯度符号法（NI-FGSM）和负向迭代快速梯度法（NI-FGM），以及其动量变体NMI-FGSM与NMI-FGM。实验表明，此类对抗样本可有效攻击机器学习系统。更重要的是，结果揭示对抗样本并非仅分布在数据邻域，而是广泛分布于整个样本空间。
原文摘要 · Abstract (English)
Most machine learning models are vulnerable to adversarial examples, which poses security concerns on these models. Adversarial examples are crafted by applying subtle but intentionally worst-case modifications to examples from the dataset, leading the model to output a different answer from the original example. In this paper, adversarial examples are formed in an exactly opposite manner, which are significantly different from the original examples but result in the same answer. We propose a novel set of algorithms to produce such adversarial examples, including the negative iterative fast gradient sign method (NI-FGSM) and the negative iterative fast gradient method (NI-FGM), along with their momentum variants: the negative momentum iterative fast gradient sign method (NMI-FGSM) and the negative momentum iterative fast gradient method (NMI-FGM). Adversarial examples constructed by these methods could be used to perform an attack on machine learning systems in certain occasions. Moreover, our results show that the adversarial examples are not merely distributed in the neighbourhood of the examples from the dataset; instead, they are distributed extensively in the sample space.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。