arXiv:2511.00411cs.LGcs.AI2025-11ICCV被引 1

通过梯度引导采样,平衡攻击强度与跨模型泛化能力。

Enhancing Adversarial Transferability by Balancing Exploration and Exploitation with Gradient-Guided Sampling

  • 引入梯度引导的采样机制,动态调节探索与利用。
  • 在多种模型上实现更强的迁移攻击效果,超越现有方法。
  • 适合研究对抗攻击迁移性及提升攻击鲁棒性的研究人员。

对抗攻击对深度神经网络的鲁棒性构成严峻挑战,尤其在不同模型架构间的迁移场景中。然而,对抗攻击的迁移性面临‘利用’(最大化攻击效力)与‘探索’(增强跨模型泛化)之间的根本矛盾。传统基于动量的方法过度侧重利用,导致攻击效力高但泛化性弱(损失曲面狭窄);而近期采用内循环采样的方法则过度侧重探索,虽增强泛化性但攻击效力下降(次优局部极值)。为此,本文提出一种简单有效的梯度引导采样(GGS)方法,通过沿梯度上升方向引导采样,同时提升采样效率与稳定性。具体地,在MI-FGSM基础上,GGS引入内循环随机采样,并利用前一内循环的梯度指导采样方向(采样幅度由随机分布决定),促使对抗样本位于兼具平坦性(利于跨模型泛化)和高局部极值(强攻击效力)的平衡区域。在多种DNN架构及多模态大语言模型(MLLMs)上的大量实验表明,该方法显著优于当前最优迁移攻击方法。代码已公开于 https://github.com/anuin-cat/GGS。

原文摘要 · Abstract (English)

Adversarial attacks present a critical challenge to deep neural networks' robustness, particularly in transfer scenarios across different model architectures. However, the transferability of adversarial attacks faces a fundamental dilemma between Exploitation (maximizing attack potency) and Exploration (enhancing cross-model generalization). Traditional momentum-based methods over-prioritize Exploitation, i.e., higher loss maxima for attack potency but weakened generalization (narrow loss surface). Conversely, recent methods with inner-iteration sampling over-prioritize Exploration, i.e., flatter loss surfaces for cross-model generalization but weakened attack potency (suboptimal local maxima). To resolve this dilemma, we propose a simple yet effective Gradient-Guided Sampling (GGS), which harmonizes both objectives through guiding sampling along the gradient ascent direction to improve both sampling efficiency and stability. Specifically, based on MI-FGSM, GGS introduces inner-iteration random sampling and guides the sampling direction using the gradient from the previous inner-iteration (the sampling's magnitude is determined by a random distribution). This mechanism encourages adversarial examples to reside in balanced regions with both flatness for cross-model generalization and higher local maxima for strong attack potency. Comprehensive experiments across multiple DNN architectures and multimodal large language models (MLLMs) demonstrate the superiority of our method over state-of-the-art transfer attacks. Code is made available at https://github.com/anuin-cat/GGS.

对抗攻击迁移性梯度引导

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。