LFAA：利用低频扰动制作可迁移的目标对抗样本
LFAA: Crafting Transferable Targeted Adversarial Examples with Low-Frequency Perturbations
AI总结：
本文提出 LFAA，通过条件生成器生成目标对抗扰动并加入图像低频分量，以利用高频脆弱性提升目标对抗样本的跨模型迁移率。
摘要：
深度神经网络容易受到对抗攻击，这对其在现实应用中的安全性和可靠性构成了重大威胁。最引人注目的对抗攻击是基于迁移的攻击，即攻击者制作一个对抗样本来欺骗一个模型，而该样本也能欺骗其他模型。尽管以往研究在提升无目标对抗样本的可迁移性方面取得了进展，但生成能够在模型之间迁移的目标对抗样本仍是一项具有挑战性的任务。在本工作中，我们提出了一种新颖方法，通过利用深度神经网络对图像高频分量扰动的脆弱性，生成可迁移的目标对抗样本。我们观察到，将一幅图像的高频分量替换为另一幅图像的高频分量会误导深度模型，这促使我们制作包含高频信息的扰动以实现目标攻击。为此，我们提出了一种名为 Low-Frequency Adversarial Attack（LFAA，低频对抗攻击）的方法，该方法训练一个条件生成器来生成目标对抗扰动，随后将其添加到图像的低频分量中。在 ImageNet 上进行的大量实验表明，我们提出的方法显著优于最先进的方法，将目标攻击成功率提升了 3.2% 至 15.5%。
英文摘要：
Deep neural networks are susceptible to adversarial attacks, which pose a significant threat to their security and reliability in real-world applications. The most notable adversarial attacks are transfer-based attacks, where an adversary crafts an adversarial example to fool one model, which can also fool other models. While previous research has made progress in improving the transferability of untargeted adversarial examples, the generation of targeted adversarial examples that can transfer between models remains a challenging task. In this work, we present a novel approach to generate transferable targeted adversarial examples by exploiting the vulnerability of deep neural networks to perturbations on high-frequency components of images. We observe that replacing the high-frequency component of an image with that of another image can mislead deep models, motivating us to craft perturbations containing high-frequency information to achieve targeted attacks. To this end, we propose a method called Low-Frequency Adversarial Attack (\name), which trains a conditional generator to generate targeted adversarial perturbations that are then added to the low-frequency component of the image. Extensive experiments on ImageNet demonstrate that our proposed approach significantly outperforms state-of-the-art methods, improving targeted attack success rates by a margin from 3.2\% to 15.5\%.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
