用极简像素操作生成高置信度欺骗图像，暴露大模型脆弱性。
SPOOF: Simple Pixel Operations for Out-of-Distribution Fooling
- 仅通过简单像素变换生成欺骗图像，无需复杂优化
- 对ViT-B/16模型仅需少量查询即可实现近100%误分类
- 适合研究模型鲁棒性或对抗攻击的开发者
深度神经网络在图像识别任务中表现优异，但在与自然图像无关的输入上仍表现出过度自信。我们重新实现了Nguyen等人（2015）提出的基于CPPN和直接编码的进化欺骗攻击方法，应用于现代卷积和Transformer分类器。结果表明，即使在最先进的网络中，高置信度欺骗依然存在，其中基于Transformer的ViT-B/16模型最为脆弱——仅需更少查询即可实现近乎确定的误分类。为此，我们提出SPOOF，一种极简、一致且更高效的黑盒攻击方法，可生成难以识别的欺骗图像，且像素修改极小、计算开销显著降低。此外，将欺骗图像作为额外类别进行再训练仅能提供部分防御效果，因为SPOOF仍能持续欺骗，只需略多一点查询量，凸显现代深度分类器的持久脆弱性。
原文摘要 · Abstract (English)
Deep neural networks (DNNs) excel across image recognition tasks, yet continue to exhibit overconfidence on inputs that bear no resemblance to natural images. Revisiting the "fooling images" work introduced by Nguyen et al. (2015), we re-implement both CPPN-based and direct-encoding-based evolutionary fooling attacks on modern architectures, including convolutional and transformer classifiers. Our re-implementation confirm that high-confidence fooling persists even in state-of-the-art networks, with transformer-based ViT-B/16 emerging as the most susceptible--achieving near-certain misclassifications with substantially fewer queries than convolution-based models. We then introduce SPOOF, a minimalist, consistent, and more efficient black-box attack generating high-confidence fooling images. Despite its simplicity, SPOOF generates unrecognizable fooling images with minimal pixel modifications and drastically reduced compute. Furthermore, retraining with fooling images as an additional class provides only partial resistance, as SPOOF continues to fool consistently with slightly higher query budgets--highlighting persistent fragility of modern deep classifiers.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。