对抗训练让模型更抗攻击，却也让攻击更容易传播。
Defense That Attacks: How Robust Models Become Better Attackers
- 用36个模型对比对抗训练与普通训练的攻击转移效果。
- 对抗训练模型生成的扰动转移成功率显著更高。
- 提醒研究者评估模型时需关注其制造可转移攻击的能力。
深度学习在计算机视觉中取得巨大成功，但仍易受对抗攻击影响。对抗训练是提升模型鲁棒性的主流防御方法，但其对攻击迁移性的影响尚未被充分探索。本文训练了36种不同架构的模型（包括CNN和ViT），并开展全面的迁移性实验。结果揭示一个明显悖论：经过对抗训练的模型产生的扰动比标准模型更具迁移性，带来新的生态风险。为确保可复现性与进一步研究，本文公开所有模型、代码及实验脚本。此外，我们主张鲁棒性评估不仅要考察模型抵抗迁移攻击的能力，还应评估其生成可迁移对抗样本的倾向。
原文摘要 · Abstract (English)
Deep learning has achieved great success in computer vision, but remains vulnerable to adversarial attacks. Adversarial training is the leading defense designed to improve model robustness. However, its effect on the transferability of attacks is underexplored. In this work, we ask whether adversarial training unintentionally increases the transferability of adversarial examples. To answer this, we trained a diverse zoo of 36 models, including CNNs and ViTs, and conducted comprehensive transferability experiments. Our results reveal a clear paradox: adversarially trained (AT) models produce perturbations that transfer more effectively than those from standard models, which introduce a new ecosystem risk. To enable reproducibility and further study, we release all models, code, and experimental scripts. Furthermore, we argue that robustness evaluations should assess not only the resistance of a model to transferred attacks but also its propensity to produce transferable adversarial examples.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。