基于微生物遗传算法的针对可解释深度学习系统的黑盒攻击
Microbial Genetic Algorithm-based Black-box Attack against Interpretable Deep Learning Systems
AI总结：
提出 QuScore 黑盒攻击，利用微生物遗传算法和 IDLS 分数反馈高效生成可迁移对抗样本，在多种 CNN、解释模型及 ImageNet/CIFAR 上取得 95%–100% 成功率。
摘要：
深度学习模型在白盒和黑盒环境中都容易受到对抗样本的影响。尽管以往研究已经展现出很高的攻击成功率，但将 DNN 模型与解释模型耦合，在有人类专家参与时可能提供一种安全感，因为专家能够识别给定样本是良性还是恶意的。然而，在白盒环境中，可解释深度学习系统（IDLSes）已被证明容易受到恶意操纵。在黑盒设置下，由于对 IDLSes 各组成部分的访问受到限制，攻击者欺骗该系统变得更具挑战性。在本工作中，我们提出了一种针对 IDLSes 的查询高效、基于分数的黑盒攻击 QuScore，该攻击不需要了解目标模型及其耦合解释模型。QuScore 通过采用有效的微生物遗传算法，建立在基于迁移和基于分数的方法之上。我们的方法旨在减少实施成功攻击所需的查询次数，从而形成更高效的过程。通过根据来自 IDLS 的反馈分数持续改进所生成的对抗样本，我们的方法有效地在搜索空间中导航，以识别能够欺骗该系统的扰动。我们使用 ImageNet 和 CIFAR 数据集，在四种 CNN 模型（Inception、ResNet、VGG、DenseNet）和两种解释模型（CAM、Grad）上评估了攻击的有效性。结果表明，所提出的方法具有查询高效性和很高的攻击成功率，成功率可达 95% 至 100%，并且在 ImageNet 和 CIFAR 数据集中具有平均成功率为 69% 的可迁移性。我们的攻击方法生成的对抗样本具有类似于良性样本的归因图。我们还证明了该攻击对各种预处理防御技术具有韧性，并且可以轻松迁移到不同的 DNN 模型。
英文摘要：
Deep learning models are susceptible to adversarial samples in white and black-box environments. Although previous studies have shown high attack success rates, coupling DNN models with interpretation models could offer a sense of security when a human expert is involved, who can identify whether a given sample is benign or malicious. However, in white-box environments, interpretable deep learning systems (IDLSes) have been shown to be vulnerable to malicious manipulations. In black-box settings, as access to the components of IDLSes is limited, it becomes more challenging for the adversary to fool the system. In this work, we propose a Query-efficient Score-based black-box attack against IDLSes, QuScore, which requires no knowledge of the target model and its coupled interpretation model. QuScore is based on transfer-based and score-based methods by employing an effective microbial genetic algorithm. Our method is designed to reduce the number of queries necessary to carry out successful attacks, resulting in a more efficient process. By continuously refining the adversarial samples created based on feedback scores from the IDLS, our approach effectively navigates the search space to identify perturbations that can fool the system. We evaluate the attack's effectiveness on four CNN models (Inception, ResNet, VGG, DenseNet) and two interpretation models (CAM, Grad), using both ImageNet and CIFAR datasets. Our results show that the proposed approach is query-efficient with a high attack success rate that can reach between 95% and 100% and transferability with an average success rate of 69% in the ImageNet and CIFAR datasets. Our attack method generates adversarial examples with attribution maps that resemble benign samples. We have also demonstrated that our attack is resilient against various preprocessing defense techniques and can easily be transferred to different DNN models.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
