用超像素划分图像区域，提升黑盒对抗攻击成功率。
Superpixel Attack: Enhancing Black-box Adversarial Attack with Image-driven Division Areas
- 以超像素替代矩形区域，更精准定位扰动位置。
- 平均攻击成功率提升2.10%，在强防御模型上效果显著。
- 适合研究对抗攻击与防御的学者及安全系统开发者。
深度学习模型被广泛应用于自动驾驶、人脸识别等安全关键任务中。然而，输入中的微小扰动可能引发预测结果的显著变化。对抗攻击用于发现导致误分类的小扰动。为开发更有效的防御机制，亟需更强大的黑盒对抗攻击方法。现有方法在单次迭代中采用简单矩形作为扰动区域。本文提出使用超像素代替矩形，其在颜色差异与区域紧凑性之间取得良好平衡。同时引入新型搜索策略——通用搜索，并提出新攻击方法：超像素攻击（Superpixel Attack）。该方法结合超像素与通用搜索，在多个具备强抗扰动能力的模型上，平均攻击成功率提升2.10%。实验代码已开源于https://github.com/oe1307/SuperpixelAttack.git。
原文摘要 · Abstract (English)
Deep learning models are used in safety-critical tasks such as automated driving and face recognition. However, small perturbations in the model input can significantly change the predictions. Adversarial attacks are used to identify small perturbations that can lead to misclassifications. More powerful black-box adversarial attacks are required to develop more effective defenses. A promising approach to black-box adversarial attacks is to repeat the process of extracting a specific image area and changing the perturbations added to it. Existing attacks adopt simple rectangles as the areas where perturbations are changed in a single iteration. We propose applying superpixels instead, which achieve a good balance between color variance and compactness. We also propose a new search method, versatile search, and a novel attack method, Superpixel Attack, which applies superpixels and performs versatile search. Superpixel Attack improves attack success rates by an average of 2.10% compared with existing attacks. Most models used in this study are robust against adversarial attacks, and this improvement is significant for black-box adversarial attacks. The code is avilable at https://github.com/oe1307/SuperpixelAttack.git.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。