通过优化攻击序列提升文本黑盒攻击成功率。
OASIS: Optimizing Attacker Sequences for Hard-Label Black-Box Text Attacks
- 设计双目标搜索算法，自动寻找最优攻击序列组合。
- 在多个数据集上实现更高成功率且扰动更小。
- 适合安全研究者与对抗样本防御开发者参考。
不同攻击方法遵循不同的搜索路径，对不同样本有效；现有硬标签黑盒文本攻击主要聚焦于改进单一攻击器或手动组合。本文提出OASIS，一种优化硬标签黑盒文本攻击中攻击序列的方法。OASIS首先进行一次性的双目标攻击链搜索，在攻击成功率和扰动之间取得平衡，随后在攻击执行阶段复用选定的固定全局攻击链。跨多个数据集、目标模型及大语言模型的实验表明，OASIS始终优于强基线独立攻击器和简单的人工构造链。结果表明，攻击组合不仅是实现方式选择，更是提升硬标签黑盒文本攻击性能的实际优化目标。
原文摘要 · Abstract (English)
Different attack methods follow different search trajectories, they succeed on different subsets of samples, whereas existing hard-label black-box text attacks mainly focus on improving individual attackers or manually combining them. We present OASIS, a method for optimizing attacker sequences in hard-label black-box text attacks. OASIS first performs a one-time bi-objective attack chain search over candidate sequences to balance attack success rate and perturbation, and then reuses the selected fixed global chain during attack chain execution. Experiments across multiple datasets, victim models, and large language models show that OASIS consistently outperforms strong standalone baselines and simple manually constructed chains. These results suggest that attacker composition is not merely an implementation choice, but a practical optimization target for improving hard-label black-box text attacks.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。