arXiv 2401.060312024-01-30cs.CV

GE-AdvGAN：通过基于梯度编辑的对抗生成模型提升对抗样本的迁移性

GE-AdvGAN: Improving the transferability of adversarial samples by gradient editing-based adversarial generative model

The University of Sydney（悉尼大学）；University of Malaya（马来亚大学）；Suzhou Yierqi（苏州意尔奇）；The University of Texas at San Antonio（德克萨斯大学圣安东尼奥分校）；University of Wollongong（伍伦贡大学）

Zhiyu Zhu, Huaming Chen, Xinyi Wang, Jiayu Zhang, Zhibo Jin, Kim-Kwang Raymond Choo, Jun Shen, Dong Yuan

备注：: Accepted by SIAM International Conference on Data Mining (SDM24)

阅读 PDF

arXiv 页面 ↗HTML 原文 ↗

AI总结：

针对现有基于GAN的对抗攻击迁移性不足、部分梯度类攻击生成效率低的问题，提出GE-AdvGAN算法，通过梯度编辑机制和频域导向优化生成器训练，实现高迁移性对抗样本的高效生成，经大规模实验验证性能优于现有方法。

摘要：

生成对抗网络（GAN）等对抗生成模型被广泛应用于生成图像、文本、音频等各类数据。其优异的性能也催生了白盒与黑盒攻击场景下基于GAN的对抗攻击方法。可迁移黑盒攻击的重要性在于其能在不同模型和设置下生效，更贴近真实应用场景。然而，这类方法在可迁移对抗样本的性能维持上仍存在挑战。同时我们发现，部分增强型基于梯度的可迁移对抗攻击算法需要较长的对抗样本生成时间。因此，本文提出一种名为GE-AdvGAN的新型算法，在提升对抗样本迁移性的同时提高算法效率。核心思路是优化生成器参数的训练过程。通过功能与特征相似性分析，我们提出了一种新型梯度编辑（GE）机制，并验证了其在多种模型上生成可迁移样本的可行性。此外，通过利用频域信息确定梯度编辑方向，GE-AdvGAN能够生成高迁移性的对抗样本，同时与现有最优的可迁移对抗攻击算法相比，执行时间更短。我们在不同数据集上开展了大规模实验，全面评估了GE-AdvGAN的性能，结果证明了该算法的优越性。算法代码可在以下链接获取：https://github.com/LMBTough/GE-advGAN

英文摘要：

Adversarial generative models, such as Generative Adversarial Networks (GANs), are widely applied for generating various types of data, i.e., images, text, and audio. Accordingly, its promising performance has led to the GAN-based adversarial attack methods in the white-box and black-box attack scenarios. The importance of transferable black-box attacks lies in their ability to be effective across different models and settings, more closely aligning with real-world applications. However, it remains challenging to retain the performance in terms of transferable adversarial examples for such methods. Meanwhile, we observe that some enhanced gradient-based transferable adversarial attack algorithms require prolonged time for adversarial sample generation. Thus, in this work, we propose a novel algorithm named GE-AdvGAN to enhance the transferability of adversarial samples whilst improving the algorithm's efficiency. The main approach is via optimising the training process of the generator parameters. With the functional and characteristic similarity analysis, we introduce a novel gradient editing (GE) mechanism and verify its feasibility in generating transferable samples on various models. Moreover, by exploring the frequency domain information to determine the gradient editing direction, GE-AdvGAN can generate highly transferable adversarial samples while minimizing the execution time in comparison to the state-of-the-art transferable adversarial attack algorithms. The performance of GE-AdvGAN is comprehensively evaluated by large-scale experiments on different datasets, which results demonstrate the superiority of our algorithm. The code for our algorithm is available at: https://github.com/LMBTough/GE-advGAN

机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。