[论文解读] Patch-wise++ Perturbation for Adversarial Targeted Attacks

Lianli Gao, Qilong Zhang+2 more|arXiv (Cornell University)|Dec 31, 2020

Adversarial Robustness in Machine Learning参考文献 52被引用 7

一句话总结

本文提出 Patch-wise++ (PIM++)，一种基于梯度的对抗性攻击方法，通过使用区域级噪声放大和温度控制的投影核，提升定向攻击的迁移性。与最先进方法相比，该方法在防御模型上的成功率提升33.1%，在正常训练模型上提升31.4%，同时保持近乎完美的白盒性能。

ABSTRACT

Although great progress has been made on adversarial attacks for deep neural networks (DNNs), their transferability is still unsatisfactory, especially for targeted attacks. There are two problems behind that have been long overlooked: 1) the conventional setting of $T$ iterations with the step size of $ε/T$ to comply with the $ε$-constraint. In this case, most of the pixels are allowed to add very small noise, much less than $ε$; and 2) usually manipulating pixel-wise noise. However, features of a pixel extracted by DNNs are influenced by its surrounding regions, and different DNNs generally focus on different discriminative regions in recognition. To tackle these issues, our previous work proposes a patch-wise iterative method (PIM) aimed at crafting adversarial examples with high transferability. Specifically, we introduce an amplification factor to the step size in each iteration, and one pixel's overall gradient overflowing the $ε$-constraint is properly assigned to its surrounding regions by a project kernel. But targeted attacks aim to push the adversarial examples into the territory of a specific class, and the amplification factor may lead to underfitting. Thus, we introduce the temperature and propose a patch-wise++ iterative method (PIM++) to further improve transferability without significantly sacrificing the performance of the white-box attack. Our method can be generally integrated to any gradient-based attack methods. Compared with the current state-of-the-art attack methods, we significantly improve the success rate by 33.1\% for defense models and 31.4\% for normally trained models on average.

研究动机与目标

• 为解决黑盒设置下定向对抗性攻击迁移性有限的问题，尤其是针对防御模型的情况。
• 克服传统像素级扰动的局限性，这些扰动无法与不同深度神经网络中的判别区域对齐。
• 在不牺牲白盒攻击成功率的前提下提升迁移性，而这种成功率通常因激进的噪声放大而受损。
• 开发一种可与现有基于梯度的攻击方法兼容的通用框架。
• 探究区域同质性噪声与温度缩放如何更有效地利用深度神经网络中的内在分类逻辑。

提出的方法

• 提出一种分块迭代方法（PIM），通过投影核将超出 ε 边界的梯度分配给周围区域，实现区域级噪声分布。
• 应用放大因子以逐次增加步长，提升扰动幅度并扩大对判别区域的覆盖范围。
• 引入温度超参数以控制梯度流动，缓解因放大导致的定向攻击中欠拟合问题。
• 采用启发式投影策略重新分配梯度溢出，而非直接裁剪，以保留有用的梯度信息。
• 使用投影核将像素的梯度在其邻域内传播，促进扰动的空间一致性。
• 通过将 PIM++ 机制集成到 FGSM 及其变体等现有方法中，实现对任意基于梯度攻击的泛化。

实验结果

研究问题

• RQ1 与像素级噪声相比，区域级（分块级）扰动是否能提升定向对抗性样本的迁移性？
• RQ2 在迭代过程中放大步长对迁移性和白盒攻击性能有何影响？
• RQ3 温度缩放是否能有效缓解因激进放大导致的定向攻击中的欠拟合问题？
• RQ4 与标准裁剪相比，投影核在多大程度上减少了梯度信息损失？
• RQ5 在黑盒设置下，PIM++ 与最先进攻击方法相比表现如何，尤其是在对抗性训练模型上的表现？

主要发现

• PIM++ 在黑盒模型上实现了平均 68.1% 的定向攻击成功率，比 DTMPo-FGSM 高出 31.4%。
• 在对抗性训练模型（EAT）上，DTPI-FGSM++ 达到 53.4% 的成功率，比 DTMPo-FGSM 高出 33.1%。
• 当保留模型为 Res-101 时，DTPI-FGSM++ 与 DTMPo-FGSM 之间的性能差距达到 33.9%。
• 在白盒设置下，所有 PIM++ 变体在集成模型上均实现接近 100% 的成功率，优于 DI-FGSM 和 DTMPo-FGSM（低于 90%）。
• 该方法在保持强大白盒性能（AoE 中超过 93%）的同时，显著提升了黑盒迁移性，表现出对模型差异的鲁棒性。
• 投影核与温度机制共同减少了梯度损失，并促进了向全局最优区域的收敛，从而增强了迁移性。