重新思考 Mixup 以提升对抗迁移性
Rethinking Mixup for Improving the Adversarial Transferability
AI总结：
本文提出 MIST 攻击方法，通过随机混合图像并分离梯度来提升对抗样本迁移性，在 CNNs 和 ViTs 上显著优于现有基于输入变换的 SOTA 攻击。
摘要：
Mixup 增强已被广泛用于生成对抗样本，使其在从代理模型迁移到其他模型时具有优越的对抗迁移性。然而，影响 Mixup 对迁移性作用的底层机制仍未得到探索。在这项工作中，我们提出：位于不同类别决策边界交汇处的对抗样本表现出更好的迁移性，并发现 Admix 倾向于将对抗样本引导至此类区域。但是，我们发现 Admix 中对所添加图像的约束削弱了其能力，导致迁移性有限。为解决这一问题，我们提出一种新的基于输入变换的攻击方法，称为 Mixing the Image but Separating the gradienT (MIST)。具体而言，MIST 将输入图像与随机平移后的图像随机混合，并为每个混合图像分离各损失项的梯度。为应对不精确的梯度，MIST 对每个输入样本在多个混合图像上计算梯度。在 ImageNet 数据集上的大量实验结果表明，MIST 在卷积神经网络（CNNs）和视觉 Transformer（ViTs）上，无论是否配备防御机制，都以明显优势优于现有 SOTA 基于输入变换的攻击方法，证明了 MIST 的高效性和通用性。
英文摘要：
Mixup augmentation has been widely integrated to generate adversarial examples with superior adversarial transferability when immigrating from a surrogate model to other models. However, the underlying mechanism influencing the mixup's effect on transferability remains unexplored. In this work, we posit that the adversarial examples located at the convergence of decision boundaries across various categories exhibit better transferability and identify that Admix tends to steer the adversarial examples towards such regions. However, we find the constraint on the added image in Admix decays its capability, resulting in limited transferability. To address such an issue, we propose a new input transformation-based attack called Mixing the Image but Separating the gradienT (MIST). Specifically, MIST randomly mixes the input image with a randomly shifted image and separates the gradient of each loss item for each mixed image. To counteract the imprecise gradient, MIST calculates the gradient on several mixed images for each input sample. Extensive experimental results on the ImageNet dataset demonstrate that MIST outperforms existing SOTA input transformation-based attacks with a clear margin on both Convolutional Neural Networks (CNNs) and Vision Transformers (ViTs) w/wo defense mechanisms, supporting MIST's high effectiveness and generality.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
