用简单图像滤波器生成对抗样本，效率高且能跨模型攻击。
Almost for Free: Crafting Adversarial Examples with Convolutional Image Filters
- 基于边缘检测算法设计可欺骗模型的对抗滤波器。
- 3×3滤波器在不同网络上成功率30%至80%，仅需一次前向传播。
- 参数量比生成模型少五数量级，适合快速部署与分析。
机器学习中的对抗样本通常通过梯度生成，或通过查询模型近似获取。本文提出一种更简单的方法，受可解释性机器学习启发，设计基于经典边缘检测算法的对抗图像滤波器，并优化其以欺骗神经网络。所提无目标攻击具有强迁移性，仅需对输入执行一次前向传播。实验表明，3×3滤波器在多个神经网络上成功率达30%至80%。相比使用生成模型的方法，参数量减少五个数量级，攻击效率显著提升。分析学习到的滤波器参数发现，其具备高迁移性，且结构与经典图像滤波器相似。结果揭示了神经网络对恶意噪声的脆弱性。
原文摘要 · Abstract (English)
Adversarial examples in machine learning are typically generated using gradients, obtained either directly through access to the model or approximated via queries to it. In this paper, we propose a much simpler approach to craft adversarial examples, drawing inspiration from insights of explainable machine learning. In particular, we design \emph{adversarial image filters} that are based on classic edge detection algorithms but optimized to deceive learning models. The resulting untargeted attacks are transferable and require only a single pass over the input. Empirically, we find that 3x3 filters already enable success rates between 30% and 80% on different neural networks. Compared to related approaches using generative models for crafting adversarial examples, we reduce the number of parameters by five orders of magnitude, resulting in a very efficient attack. When investigating the parameters of the learned filters, we observe interesting properties such as a high transferability between models and structures common to classic image filters. Our results provide further insights into the vulnerability of neural networks and their fragility to malicious noise.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。