通过任意风格迁移提升对抗样本的可迁移性
Improving the Transferability of Adversarial Examples with Arbitrary Style Transfer
AI总结：
针对对抗样本黑盒场景可迁移性弱的问题，提出基于任意风格迁移的STM攻击方法，通过跨域数据增强、微调网络及图像混合提升可迁移性，在ImageNet数据集上效果优于现有同类方法。
摘要：
深度神经网络易受对抗样本攻击，这类样本通过在干净输入上添加人类无法察觉的扰动生成。尽管许多攻击方法在白盒设置下能实现很高的成功率，但在黑盒设置下的可迁移性较弱。近年来，研究者提出了多种提升对抗可迁移性的方法，其中输入变换是最有效的方法之一。在本研究中，我们注意到现有基于输入变换的工作主要采用同域内的变换数据做增强。受域泛化的启发，我们旨在利用来自不同域的增强数据进一步提升可迁移性。具体而言，风格迁移网络可以改变图像中低层视觉特征的分布，同时保留人类可识别的语义内容。因此，我们提出了一种名为Style Transfer Method（STM，风格迁移法）的新型攻击方法，该方法利用我们提出的任意风格迁移网络将图像变换到不同域。为避免风格化图像对于分类网络的语义信息不一致，我们对风格迁移网络进行微调，并将添加了随机噪声的生成图像与原始图像混合，以保持语义一致性并提升输入多样性。在ImageNet兼容数据集上的大量实验结果表明，与当前最先进的基于输入变换的攻击方法相比，我们提出的方法无论是在正常训练的模型还是对抗训练的模型上，都能显著提升对抗可迁移性。代码可在以下链接获取：https://github.com/Zhijin-Ge/STM。
英文摘要：
Deep neural networks are vulnerable to adversarial examples crafted by applying human-imperceptible perturbations on clean inputs. Although many attack methods can achieve high success rates in the white-box setting, they also exhibit weak transferability in the black-box setting. Recently, various methods have been proposed to improve adversarial transferability, in which the input transformation is one of the most effective methods. In this work, we notice that existing input transformation-based works mainly adopt the transformed data in the same domain for augmentation. Inspired by domain generalization, we aim to further improve the transferability using the data augmented from different domains. Specifically, a style transfer network can alter the distribution of low-level visual features in an image while preserving semantic content for humans. Hence, we propose a novel attack method named Style Transfer Method (STM) that utilizes a proposed arbitrary style transfer network to transform the images into different domains. To avoid inconsistent semantic information of stylized images for the classification network, we fine-tune the style transfer network and mix up the generated images added by random noise with the original images to maintain semantic consistency and boost input diversity. Extensive experimental results on the ImageNet-compatible dataset show that our proposed method can significantly improve the adversarial transferability on either normally trained models or adversarially trained models than state-of-the-art input transformation-based attacks. Code is available at: https://github.com/Zhijin-Ge/STM.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
