arXivDaily arXiv每日学术速递 周一至周五更新
arXiv 2407.20653cs.CVcs.AIcs.LG

FACL-Attack:面向可迁移对抗攻击的频率感知对比学习

FACL-Attack: Frequency-Aware Contrastive Learning for Transferable Adversarial Attacks

KAIST(韩国科学技术院);Agency for Defense Development(国防发展厅)

Hunmin Yang, Jongoh Jeong, Kuk-Jin Yoon

AI总结:

本文提出了一种在频域进行特征对比的方法,通过FADR和FACL模块生成在跨域和跨模型设置下具有强大可迁移性的对抗样本,同时保持推理时间复杂度。

摘要:

深度神经网络由于对抗样本固有的可迁移性,已知容易受到安全风险的威胁。尽管近期基于生成模型的攻击取得了成功并展现出强大的可迁移性,但在现实世界严格黑盒环境下设计高效的攻击策略仍然是一个挑战,因为目标领域和模型架构都是未知的。在本文中,我们试图在频域中探索一种特征对比方法,以生成在跨域和跨模型设置下均具有鲁棒性的对抗样本。基于这一目标,我们提出了两个仅在训练阶段使用的模块:一个是 Frequency-Aware Domain Randomization (FADR) 模块,用于随机化随域变化的低频和高频成分;另一个是 Frequency-Augmented Contrastive Learning (FACL) 模块,用于有效分离干净图像和扰动图像的域不变中频特征。我们通过广泛的跨域和跨模型实验,证明了所生成对抗扰动的强大可迁移性,同时保持了推理时间复杂度。

英文摘要:

Deep neural networks are known to be vulnerable to security risks due to the inherent transferable nature of adversarial examples. Despite the success of recent generative model-based attacks demonstrating strong transferability, it still remains a challenge to design an efficient attack strategy in a real-world strict black-box setting, where both the target domain and model architectures are unknown. In this paper, we seek to explore a feature contrastive approach in the frequency domain to generate adversarial examples that are robust in both cross-domain and cross-model settings. With that goal in mind, we propose two modules that are only employed during the training phase: a Frequency-Aware Domain Randomization (FADR) module to randomize domain-variant low- and high-range frequency components and a Frequency-Augmented Contrastive Learning (FACL) module to effectively separate domain-invariant mid-frequency features of clean and perturbed image. We demonstrate strong transferability of our generated adversarial perturbations through extensive cross-domain and cross-model experiments, while keeping the inference time complexity.

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑