[论文解读] Enhancing the Transferability of Adversarial Attacks through Variance Tuning

Xiaosen Wang, Kun He|arXiv (Cornell University)|Mar 29, 2021

Adversarial Robustness in Machine Learning参考文献 36被引用 26

一句话总结

这篇论文引入方差调优来对梯度为基础的迭代对抗攻击，以提升转移性，特别是对抗黑盒防御，同时保持白盒成功率。它在 ImageNet 和输入变换与集成模型上显示出显著提升。

ABSTRACT

Deep neural networks are vulnerable to adversarial examples that mislead the models with imperceptible perturbations. Though adversarial attacks have achieved incredible success rates in the white-box setting, most existing adversaries often exhibit weak transferability in the black-box setting, especially under the scenario of attacking models with defense mechanisms. In this work, we propose a new method called variance tuning to enhance the class of iterative gradient based attack methods and improve their attack transferability. Specifically, at each iteration for the gradient calculation, instead of directly using the current gradient for the momentum accumulation, we further consider the gradient variance of the previous iteration to tune the current gradient so as to stabilize the update direction and escape from poor local optima. Empirical results on the standard ImageNet dataset demonstrate that our method could significantly improve the transferability of gradient-based adversarial attacks. Besides, our method could be used to attack ensemble models or be integrated with various input transformations. Incorporating variance tuning with input transformations on iterative gradient-based attacks in the multi-model setting, the integrated method could achieve an average success rate of 90.1% against nine advanced defense methods, improving the current best attack performance significantly by 85.1% . Code is available at https://github.com/JHL-HUST/VT.

研究动机与目标

• 激发并提升基于梯度的对抗样本的转移性，特别是针对受防御的（黑盒）模型。
• 提出一种方差调优机制，以在迭代过程中稳定梯度更新。
• 证明将方差调优与输入变换和集成模型结合时能增强攻击效果。
• 表明所提出的方法在显著提升黑盒成功率的同时，保持白盒性能。

提出的方法

• 在当前输入的邻域内定义梯度方差。
• 在每次迭代中，在动量步骤前，利用邻域方差对当前梯度进行调优。
• 使用方差调优后梯度的符号以固定步长更新对抗样本。
• 将该方法扩展到 NI-FGSM 以及 DIM/TIM/SIM 输入变换（CTM）。
• 在邻域内使用采样（N）来近似梯度方差，并设定邻域界限（beta）。
• 在 ImageNet 上对正常训练和对抗性训练的模型进行评估，包括九个防御模型。

实验结果

研究问题

• RQ1 方差调优是否能提高迭代梯度基攻击对未知模型或被防御模型的转移性？
• RQ2 方差调优的超参数（邻域大小 beta 与采样数量 N）如何影响转移性和计算成本？

主要发现

• 方差调优的攻击（VMI-FGSM/VNI-FGSM）在黑盒模型上优于基线 MI-FGSM/NI-FGSM，同时保持白盒性能高水平。
• 将方差调优与输入变换（DIM/TIM/SIM）结合，进一步提升转移性，尤其是针对对抗性训练的模型。
• 在集成设置中，方差调优攻击相对于基线取得显著提升，对高级防御也有明显改进。
• 在九个防御模型上，集成方法在多模型设定下达到平均成功率90.1%，比基线高出6.6%。
• 消融分析显示 beta 约为 1.5、N 约为 20 能在转移性与计算成本之间取得平衡。