通过注意力引导的对抗修复生成可迁移且隐蔽的对抗补丁
Generating Transferable and Stealthy Adversarial Patch via Attention-guided Adversarial Inpainting
AI总结：
针对现有对抗补丁易察觉、跨模型迁移性弱的问题，提出两阶段Adv-Inpainting攻击方法，通过注意力引导融合特征并优化补丁，实现了更隐蔽、可迁移性更强的人脸识别对抗攻击。
摘要：
对抗补丁攻击可通过小型补丁欺骗人脸识别（FR）模型。然而，以往的对抗补丁攻击往往会产生不自然的图案，极易被察觉。由于源图像与目标图像之间存在巨大的风格差异，生成既能高效欺骗黑盒FR模型、又具备良好伪装性的可迁移且隐蔽的对抗补丁颇具挑战。为生成可迁移、外观自然且隐蔽的对抗补丁，我们提出了一种名为Adv-Inpainting的创新两阶段攻击方法，该方法分别从攻击者面部和目标面部提取风格特征与身份特征，随后在注意力图的引导下用具有误导性且不显眼的内容填充补丁。在第一阶段，我们通过类金字塔网络提取多尺度风格嵌入，通过预训练FR模型提取身份嵌入，并提出了一种新型注意力引导自适应实例归一化层（AAIN），通过背景-补丁交叉注意力图融合二者。该层可充分利用优先级上下文信息，自适应融合身份嵌入与风格嵌入。在第二阶段，我们设计了对抗补丁优化网络（APR-Net），搭配新型边界方差损失、空间折扣重建损失与感知损失，进一步提升隐蔽性。实验表明，与当前最优的对抗补丁攻击和语义攻击相比，我们的攻击方法生成的对抗补丁视觉质量更优、隐蔽性更强、可迁移性更佳。
英文摘要：
Adversarial patch attacks can fool the face recognition (FR) models via small patches. However, previous adversarial patch attacks often result in unnatural patterns that are easily noticeable. Generating transferable and stealthy adversarial patches that can efficiently deceive the black-box FR models while having good camouflage is challenging because of the huge stylistic difference between the source and target images. To generate transferable, natural-looking, and stealthy adversarial patches, we propose an innovative two-stage attack called Adv-Inpainting, which extracts style features and identity features from the attacker and target faces, respectively and then fills the patches with misleading and inconspicuous content guided by attention maps. In the first stage, we extract multi-scale style embeddings by a pyramid-like network and identity embeddings by a pretrained FR model and propose a novel Attention-guided Adaptive Instance Normalization layer (AAIN) to merge them via background-patch cross-attention maps. The proposed layer can adaptively fuse identity and style embeddings by fully exploiting priority contextual information. In the second stage, we design an Adversarial Patch Refinement Network (APR-Net) with a novel boundary variance loss, a spatial discounted reconstruction loss, and a perceptual loss to boost the stealthiness further. Experiments demonstrate that our attack can generate adversarial patches with improved visual quality, better stealthiness, and stronger transferability than state-of-the-art adversarial patch attacks and semantic attacks.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
