GNP攻击：通过梯度范数惩罚实现可迁移的对抗样本
GNP Attack: Transferable Adversarial Examples via Gradient Norm Penalty
AI总结：
本文提出梯度范数惩罚（GNP）方法，通过使优化收敛到损失景观平坦区域来增强对抗样本的可迁移性，并在多个先进模型和防御方法上验证了其有效性与灵活性。
摘要：
具有良好可迁移性的对抗样本（AE）能够对多种目标模型实施实用的黑盒攻击，而无需了解目标模型的内部信息。以往方法生成的AE通常没有或仅有非常有限的可迁移性；也就是说，它们容易过拟合源白盒模型的特定架构和特征表示，生成的AE几乎无法作用于目标黑盒模型。本文提出了一种利用梯度范数惩罚（GNP）增强AE可迁移性的新方法。它促使损失函数优化过程收敛到损失景观中局部最优的平坦区域。通过攻击11个最先进的（SOTA）深度学习模型和6种先进的防御方法，我们实证表明GNP在生成高可迁移性AE方面非常有效。我们还证明该方法非常灵活，可以轻松与其他基于梯度的方法结合，以实现更强的基于迁移的攻击。
英文摘要：
Adversarial examples (AE) with good transferability enable practical black-box attacks on diverse target models, where insider knowledge about the target models is not required. Previous methods often generate AE with no or very limited transferability; that is, they easily overfit to the particular architecture and feature representation of the source, white-box model and the generated AE barely work for target, black-box models. In this paper, we propose a novel approach to enhance AE transferability using Gradient Norm Penalty (GNP). It drives the loss function optimization procedure to converge to a flat region of local optima in the loss landscape. By attacking 11 state-of-the-art (SOTA) deep learning models and 6 advanced defense methods, we empirically show that GNP is very effective in generating AE with high transferability. We also demonstrate that it is very flexible in that it can be easily integrated with other gradient based methods for stronger transfer-based attacks.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
