arXiv 2211.095652023-10-28cs.CRcs.CVcs.LG

迈向评估迁移对抗攻击的良好实践

Towards Good Practices in Evaluating Transfer Adversarial Attacks

CISPA Helmholtz Center for Information Security（CISPA亥姆霍兹信息安全中心）；LIS - Ecole Centrale Marseille（马赛中央理工学院信息科学实验室）；SKLCS, Institute of Software, CAS（中国科学院软件研究所计算机科学国家重点实验室）；University of Chinese Academy of Sciences（中国科学院大学）；Inria, Univ Rennes, CNRS, IRISA（法国国家信息与自动化研究所，雷恩大学，法国国家科学研究中心，IRISA）

Zhengyu Zhao, Hanwei Zhang, Renjue Li, Ronan Sicre, Laurent Amsaleg, Michael Backes

备注：: An extended version can be found at arXiv:2310.11850. Code and a list of categorized attacks are available at https://github.com/ZhengyuZhao/TransferAttackEval

阅读 PDF

arXiv 页面 ↗HTML 原文 ↗

AI总结：

本文针对迁移对抗攻击评估中缺乏系统公平比较和忽视隐蔽性的问题，提出分类评估框架，首次全面评估ImageNet上23种攻击对9种防御的表现，并给出可操作的良好实践。

摘要：

迁移对抗攻击在现实世界的黑盒场景中引发了严重的安全担忧。然而，由于现有评估中普遍存在两个局限，该领域的实际进展难以评估。第一，不同方法往往没有在一对一比较中得到系统且公平的评估。第二，现有工作只评估可迁移性，而另一个关键攻击属性——隐蔽性——在很大程度上被忽视。在这项工作中，我们设计了良好实践来解决这些局限，并首次对迁移攻击进行了全面评估，覆盖ImageNet上针对9种防御的23种代表性攻击。特别是，我们提出将现有攻击划分为五个类别，从而支持系统性的分类分析。这些分析带来了新的发现，甚至挑战了已有认知，同时也有助于为我们的逐攻击全面评估确定最优攻击超参数。我们还特别关注隐蔽性，采用多种不可感知性度量指标，并考察新的、更细粒度的特征。总体而言，我们对可迁移性和隐蔽性的新见解为未来评估提供了可操作的良好实践。

英文摘要：

Transfer adversarial attacks raise critical security concerns in real-world, black-box scenarios. However, the actual progress of this field is difficult to assess due to two common limitations in existing evaluations. First, different methods are often not systematically and fairly evaluated in a one-to-one comparison. Second, only transferability is evaluated but another key attack property, stealthiness, is largely overlooked. In this work, we design good practices to address these limitations, and we present the first comprehensive evaluation of transfer attacks, covering 23 representative attacks against 9 defenses on ImageNet. In particular, we propose to categorize existing attacks into five categories, which enables our systematic category-wise analyses. These analyses lead to new findings that even challenge existing knowledge and also help determine the optimal attack hyperparameters for our attack-wise comprehensive evaluation. We also pay particular attention to stealthiness, by adopting diverse imperceptibility metrics and looking into new, finer-grained characteristics. Overall, our new insights into transferability and stealthiness lead to actionable good practices for future evaluations.

机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。