模型模仿攻击：用于可证明可迁移对抗样本的知识蒸馏
Model Mimic Attack: Knowledge Distillation for Provably Transferable Adversarial Examples
AI总结：
本文提出模型模仿攻击，通过知识蒸馏迭代训练学生模型实现可迁移黑盒对抗攻击，并首次证明在有限迭代内可保证找到针对教师模型的对抗样本。
摘要：
人工神经网络在黑盒设置下对对抗扰动的脆弱性已在文献中被广泛研究。大多数构造这些扰动的攻击方法都面临一个不切实际的问题：寻找对抗样本所需的查询次数过多。在本工作中，我们聚焦于将知识蒸馏作为一种进行基于迁移的黑盒对抗攻击的方法，并提出在逐步扩展的数据集上对学生模型进行迭代训练。据我们所知，本工作是首个为基于知识蒸馏的分类神经网络攻击成功率提供可证明保证的研究：我们证明，如果学生模型具有足够的学习能力，则针对教师模型的攻击必能在有限次蒸馏迭代内被找到。
英文摘要：
The vulnerability of artificial neural networks to adversarial perturbations in the black-box setting is widely studied in the literature. The majority of attack methods to construct these perturbations suffer from an impractically large number of queries required to find an adversarial example. In this work, we focus on knowledge distillation as an approach to conduct transfer-based black-box adversarial attacks and propose an iterative training of the surrogate model on an expanding dataset. This work is the first, to our knowledge, to provide provable guarantees on the success of knowledge distillation-based attack on classification neural networks: we prove that if the student model has enough learning capabilities, the attack on the teacher model is guaranteed to be found within the finite number of distillation iterations.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
