用双层极小极大优化提升对抗样本迁移效率与可靠性
Learning with Bilevel-Minimax Optimization for Efficient and Reliable Transfer Attacks
- 从双层极小极大视角建模初始化、适配与扰动的耦合关系
- 在30多个模型上超越10+基线，跨架构迁移性能提升2倍
- 适合研究对抗攻击、模型鲁棒性及优化算法的学者
基于迁移的对抗攻击通过替代模型生成扰动以误导黑盒目标模型。除了扰动生成，迁移能力本质上由初始化、替代模型适配与梯度动态之间的耦合决定。本文从双层极小极大视角重新审视该问题，提出BMAT（Bilevel-Minimax Adversarial Transfer）方法。其双层框架捕捉了初始化与扰动间的依赖关系，内层极小极大问题则促进替代模型的鲁棒性以实现跨架构泛化。算法上，我们设计了一种自下而上的集成求解器，结合软权重调制器与隐式梯度近似器，实现初始化、替代适配与扰动优化三者的紧密耦合。此外，我们提供了所提双层极小极大框架的优化动态理论分析。在分类与分割基准上的大量实验表明，BMAT在超过30个目标模型上优于10多个强基线，显著提升同类与跨架构迁移能力，最高可使mIoU降低2倍。代码已开源：https://github.com/callous-youth/BMAT。
原文摘要 · Abstract (English)
Transfer-based adversarial attacks craft adversarial examples using surrogate models to mislead black-box victim models. Beyond perturbation generation, transferability is fundamentally governed by the coupling of initialization, surrogate adaptation, and gradient dynamics. We revisit this challenge from a bilevel-minimax perspective and propose BMAT (Bilevel-Minimax Adversarial Transfer). The bilevel formulation captures the dependency between initialization and perturbation, while the inner minimax problem promotes surrogate robustness for cross-architecture generalization. Algorithmically, we develop an integrated bottom-up solver that combines a Soft Weight Modulator and an Implicit Gradient Approximator to enable ternary coupling among initialization, surrogate adaptation, and perturbation optimization. We further provide theoretical insights into the optimization dynamics of the proposed bilevel-minimax framework. Extensive experiments on classification and segmentation benchmarks show that BMAT outperforms more than 10 strong baselines across more than 30 victim models, improving both intra- and cross-architecture transfer and yielding up to a 2x reduction in mIoU. Code is available at https://github.com/callous-youth/BMAT.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。