切换可转移梯度方向实现查询高效的黑盒对抗攻击
Switching Transferable Gradient Directions for Query-Efficient Black-Box Adversarial Attacks
摘要：
我们提出了一个简单的和高查询效率的黑盒对抗攻击命名为黑盒，它具有最先进的性能，在基于分数的设置。该方法的特点是高效和有效地利用代理模型$\hat{\mathbf{g}}$的梯度，输入图像，即，可转移梯度。在每一次迭代中，$\hat{\mathbf{g}}$首先尝试沿着$\hat{\mathbf{g}}$的方向更新当前样本，但是如果我们的算法检测到它没有增加攻击目标函数的值，则考虑切换到它的相反方向$-\hat{\mathbf{g}}$。我们证明了选择切换到相反的方向，由当地近似线性假设。该算法每次迭代只需要一个或两个查询，但由于可转移梯度提供了丰富的信息，因此仍然有效，从而产生了前所未有的查询效率。为了提高鲁棒性的搜索，我们进一步提出了搜索$_\text{RGF}$，其中更新遵循随机梯度自由（RGF）估计的方向时，无论是$\hat{\mathbf{g}}$，也不是它的相反方向可以增加的目标，同时保持搜索在查询效率方面的优势。在CIFAR-10、CIFAR-100和TinyImageNet上进行的实验结果表明，与其他方法相比，该方法使用更少的查询实现了令人满意的攻击成功率，而$_\text{RGF}$ $_\text{RGF}$在总体上使用更少的查询实现了最先进的攻击成功率。由于其简单性，我们的方法可以作为未来黑盒攻击的强大基线。PyTorch源代码发布在https://github.com/machanic/SWITCH上。
英文摘要：
We propose a simple and highly query-efficient black-box adversarial attack named SWITCH, which has a state-of-the-art performance in the score-based setting. SWITCH features a highly efficient and effective utilization of the gradient of a surrogate model $\hat{\mathbf{g}}$ w.r.t. the input image, i.e., the transferable gradient. In each iteration, SWITCH first tries to update the current sample along the direction of $\hat{\mathbf{g}}$, but considers switching to its opposite direction $-\hat{\mathbf{g}}$ if our algorithm detects that it does not increase the value of the attack objective function. We justify the choice of switching to the opposite direction by a local approximate linearity assumption. In SWITCH, only one or two queries are needed per iteration, but it is still effective due to the rich information provided by the transferable gradient, thereby resulting in unprecedented query efficiency. To improve the robustness of SWITCH, we further propose SWITCH$_\text{RGF}$ in which the update follows the direction of a random gradient-free (RGF) estimate when neither $\hat{\mathbf{g}}$ nor its opposite direction can increase the objective, while maintaining the advantage of SWITCH in terms of query efficiency. Experimental results conducted on CIFAR-10, CIFAR-100 and TinyImageNet show that compared with other methods, SWITCH achieves a satisfactory attack success rate using much fewer queries, and SWITCH$_\text{RGF}$ achieves the state-of-the-art attack success rate with fewer queries overall. Our approach can serve as a strong baseline for future black-box attacks because of its simplicity. The PyTorch source code is released on https://github.com/machanic/SWITCH.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
