arXiv 2312.022072023-12-03cs.CV

TranSegPGD：提升语义分割上对抗样本可迁移性的方法

TranSegPGD: Improving Transferability of Adversarial Examples on Semantic Segmentation

Nanyang Technological University（南洋理工大学）；University of Oxford（牛津大学）；Yanshan University（燕山大学）；Agency for Science, Technology and Research (A*STAR)（新加坡科技研究局）；Shenzhen Campus of Sun Yat-sen University（中山大学深圳校区）

Xiaojun Jia, Jindong Gu, Yihao Huang, Simeng Qin, Qing Guo, Yang Liu, Xiaochun Cao

阅读 PDF

arXiv 页面 ↗HTML 原文 ↗

AI总结：

本文提出两阶段攻击策略 TranSegPGD，通过按像素对抗属性和 KL 散度可迁移性分分支加权优化，提升语义分割对抗样本的可迁移性，并在多个数据集上取得最先进性能。

摘要：

图像分类中对抗样本的可迁移性已被系统研究，可在黑盒模式下生成对抗样本。然而，语义分割中对抗样本的可迁移性在很大程度上被忽视。本文提出一种有效的两阶段对抗攻击策略，以提升语义分割上对抗样本的可迁移性，称为 TranSegPGD。具体而言，在第一阶段，输入图像中的每个像素根据其对抗属性被划分到不同分支。不同分支在优化时被赋予不同权重，以提升所有像素的对抗性能。我们对难以攻击像素的损失赋予高权重，以使所有像素被错误分类。在第二阶段，像素根据其依赖于 Kullback-Leibler 散度的可迁移属性被划分到不同分支。不同分支在优化时被赋予不同权重，以提升对抗样本的可迁移性。我们对高可迁移性像素的损失赋予高权重，以提升对抗样本的可迁移性。在 PASCAL VOC 2012 和 Cityscapes 数据集上，使用多种分割模型进行了大量实验，以证明所提方法的有效性。所提出的对抗攻击方法能够取得最先进的性能。

英文摘要：

Transferability of adversarial examples on image classification has been systematically explored, which generates adversarial examples in black-box mode. However, the transferability of adversarial examples on semantic segmentation has been largely overlooked. In this paper, we propose an effective two-stage adversarial attack strategy to improve the transferability of adversarial examples on semantic segmentation, dubbed TranSegPGD. Specifically, at the first stage, every pixel in an input image is divided into different branches based on its adversarial property. Different branches are assigned different weights for optimization to improve the adversarial performance of all pixels.We assign high weights to the loss of the hard-to-attack pixels to misclassify all pixels. At the second stage, the pixels are divided into different branches based on their transferable property which is dependent on Kullback-Leibler divergence. Different branches are assigned different weights for optimization to improve the transferability of the adversarial examples. We assign high weights to the loss of the high-transferability pixels to improve the transferability of adversarial examples. Extensive experiments with various segmentation models are conducted on PASCAL VOC 2012 and Cityscapes datasets to demonstrate the effectiveness of the proposed method. The proposed adversarial attack method can achieve state-of-the-art performance.

机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。