通过早期锁定潜在目标，显著提升黑盒攻击的查询效率。
Opportunistic Target Selection: Early Directional Commitment for Query-Efficient Black-Box Adversarial Attacks
- 攻击初期动态选择当前最可能的错误类别作为目标
- 在ResNet-50上成功率最高提升27个百分点，迭代次数减少43%
- 无需梯度、不改结构，适用于无目标攻击的轻量级增强
仅最小化真实类别置信度的黑盒对抗攻击存在类别漂移问题：扰动在特征空间中漫游而不明确指向特定错误类别，导致大量查询浪费在无方向进展上。本文提出机会式目标选择（OTS），一种轻量级封装方法，在攻击轨迹早期将无目标攻击转为有目标攻击，锁定当前领先的非真实类别。OTS无需修改底层攻击架构、无需梯度访问，也无需预先知道目标类别。我们在三种基于得分的攻击（SimBA、带交叉熵损失的Square Attack、Bandits）上，针对五种标准ImageNet分类器（共4,500次实验）验证了其有效性。在随机搜索类攻击中，OTS接近理想目标攻击表现，于ResNet-50上成功率达+27个百分点，受限制平均迭代次数降低43%。在基于梯度估计的攻击（如Bandits）和使用边界损失的攻击中，OTS效果冗余，进一步支持其作为边界损失替代品的定位。在对抗训练模型上，因难度分布呈双峰状，使目标攻击不再有效。
原文摘要 · Abstract (English)
Black-box adversarial attacks that minimize only the ground-truth confidence suffer from class drift: perturbations wander through the feature space without committing to a specific adversarial class, wasting queries on diffuse, undirected progress. We introduce Opportunistic Target Selection (OTS), a lightweight wrapper that switches an untargeted attack to a targeted objective early in its trajectory, locking onto whichever non-true class currently leads. OTS requires no architectural modification to the underlying attack, no gradient access, and no a priori target-class knowledge. We validate OTS on three score-based attacks (SimBA, Square Attack with cross-entropy loss, and Bandits) across five standard ImageNet classifiers (4,500 runs). On random-search attacks, OTS closely tracks oracle performance, with gains up to +27 pp in success rate and 43% relative reduction in censored-mean iterations on ResNet-50. On gradient-estimation attacks (Bandits) and attacks with margin loss, OTS is redundant, a negative result that reinforces our interpretation of OTS as a margin-loss surrogate. On adversarially-trained models, a bimodal difficulty distribution eliminates the regime where targeting helps.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。