多重扰动攻击：不同$\ell_p$范数下的逐像素攻击以获得更好的对抗性能
Multiple Perturbation Attack: Attack Pixelwise Under Different $\ell_p$-norms For Better Adversarial Performance
摘要：
对抗性机器学习一直是一个主要的关注点，也是最近的热门话题，特别是随着深度神经网络在当前环境中的普遍使用。对抗攻击和防御通常被比作猫捉老鼠的游戏，其中防御者和攻击者随着时间的推移而演变。一方面，目标是开发强大而强大的深度网络，以抵抗恶意行为者。另一方面，为了实现这一目标，我们需要设计更强大的对抗攻击来挑战这些防御模型。大多数现有的攻击采用单个$\ell_p$距离（通常为$p\in\{1,2,\infty\}$）来定义接近度的概念，并执行相对于.该$p$ -范数以相同的方式更新对抗示例中的所有像素。这些$\ell_p$攻击各有优缺点;没有一种攻击可以成功突破同时针对多个$\ell_p$规范的防御模型。受这些观察的启发，我们提出了一种自然的方法：在像素级上组合各种$\ell_p$梯度投影，以实现联合对抗扰动。具体来说，我们学习如何扰动每个像素以最大化攻击性能，同时保持对抗性示例的整体视觉不可感知性。最后，通过使用标准化基准的各种实验，我们表明，我们的方法在最先进的防御机制中优于当前大多数强大的攻击，同时保持其在视觉上保持干净的能力。
英文摘要：
Adversarial machine learning has been both a major concern and a hot topic recently, especially with the ubiquitous use of deep neural networks in the current landscape. Adversarial attacks and defenses are usually likened to a cat-and-mouse game in which defenders and attackers evolve over the time. On one hand, the goal is to develop strong and robust deep networks that are resistant to malicious actors. On the other hand, in order to achieve that, we need to devise even stronger adversarial attacks to challenge these defense models. Most of existing attacks employs a single $\ell_p$ distance (commonly, $p\in\{1,2,\infty\}$) to define the concept of closeness and performs steepest gradient ascent w.r.t. this $p$-norm to update all pixels in an adversarial example in the same way. These $\ell_p$ attacks each has its own pros and cons; and there is no single attack that can successfully break through defense models that are robust against multiple $\ell_p$ norms simultaneously. Motivated by these observations, we come up with a natural approach: combining various $\ell_p$ gradient projections on a pixel level to achieve a joint adversarial perturbation. Specifically, we learn how to perturb each pixel to maximize the attack performance, while maintaining the overall visual imperceptibility of adversarial examples. Finally, through various experiments with standardized benchmarks, we show that our method outperforms most current strong attacks across state-of-the-art defense mechanisms, while retaining its ability to remain clean visually.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
