注意边界框：针对图像分类器的 $l_1$-APGD 稀疏对抗攻击
Mind the box: $l_1$-APGD for sparse adversarial attacks on image classifiers
AI总结：
针对图像域约束下现有 $l_1$-PGD 攻击的次优性问题，提出精确投影与自适应步长的 $l_1$-APGD 白盒攻击，并构建 $l_1$-AutoAttack 集成以可靠评估 $l_1$ 对抗鲁棒性，同时通过对抗训练实现了 SOTA 的鲁棒性。
摘要：
我们证明，当同时考虑图像域 $[0,1]^d$ 时，现有的 $l_1$-projected gradient descent (PGD) 攻击是次优的，因为它们未考虑到有效的威胁模型是 $l_1$-ball 与 $[0,1]^d$ 的交集。我们研究了该有效威胁模型下最速下降步的预期稀疏性，并证明对该集合的精确投影在计算上是可行的，且能产生更好的性能。此外，我们提出了一种自适应形式的 PGD，即使迭代预算较小也非常有效。我们最终得到的 $l_1$-APGD 是一种强大的白盒攻击，表明先前的研究高估了其 $l_1$-robustness。使用 $l_1$-APGD 进行对抗训练，我们得到了具有 SOTA $l_1$-robustness 的鲁棒分类器。最后，我们将 $l_1$-APGD 和 Square Attack 对 $l_1$ 的适应性改造结合成 $l_1$-AutoAttack，这是一个攻击集合，能够可靠地评估 $l_1$-ball 与 $[0,1]^d$ 交集这一威胁模型的对抗鲁棒性。
英文摘要：
We show that when taking into account also the image domain $[0,1]^d$, established $l_1$-projected gradient descent (PGD) attacks are suboptimal as they do not consider that the effective threat model is the intersection of the $l_1$-ball and $[0,1]^d$. We study the expected sparsity of the steepest descent step for this effective threat model and show that the exact projection onto this set is computationally feasible and yields better performance. Moreover, we propose an adaptive form of PGD which is highly effective even with a small budget of iterations. Our resulting $l_1$-APGD is a strong white-box attack showing that prior works overestimated their $l_1$-robustness. Using $l_1$-APGD for adversarial training we get a robust classifier with SOTA $l_1$-robustness. Finally, we combine $l_1$-APGD and an adaptation of the Square Attack to $l_1$ into $l_1$-AutoAttack, an ensemble of attacks which reliably assesses adversarial robustness for the threat model of $l_1$-ball intersected with $[0,1]^d$.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
