重新思考对抗攻击中的中间特征：通过对抗蒸馏误导机器人模型
Rethinking the Intermediate Features in Adversarial Attacks: Misleading Robotic Models via Adversarial Distillation
AI总结：
本文针对语言条件机器人模型提出一种基于连续动作表示和中间自注意力特征负梯度的通用对抗前缀攻击方法，在VIMA模型的13个操作任务上验证了其优越性和跨模型变体的可迁移性。
摘要：
语言条件机器人学习通过使单一模型能够响应口头指令执行多样化任务，显著增强了机器人的适应性。尽管取得了这些进展，该领域内的安全漏洞在很大程度上仍未得到探索。本文通过提出一种针对语言条件机器人模型的新型对抗提示攻击来填补这一空白。我们的方法涉及构造一个通用对抗前缀，当将其添加到任何原始提示时，会诱导模型执行非预期动作。我们证明，由于离散化机器人动作空间的固有鲁棒性，现有对抗技术在直接迁移到机器人领域时表现出有限的有效性。为克服这一挑战，我们提出基于连续动作表示优化对抗前缀，从而绕过离散化过程。此外，我们识别出中间特征对对抗攻击的有益影响，并利用中间自注意力特征的负梯度进一步增强攻击效果。在VIMA模型上跨13个机器人操作任务的大量实验验证了我们的方法相对于现有方法的优越性，并证明了其在不同模型变体之间的可迁移性。
英文摘要：
Language-conditioned robotic learning has significantly enhanced robot adaptability by enabling a single model to execute diverse tasks in response to verbal commands. Despite these advancements, security vulnerabilities within this domain remain largely unexplored. This paper addresses this gap by proposing a novel adversarial prompt attack tailored to language-conditioned robotic models. Our approach involves crafting a universal adversarial prefix that induces the model to perform unintended actions when added to any original prompt. We demonstrate that existing adversarial techniques exhibit limited effectiveness when directly transferred to the robotic domain due to the inherent robustness of discretized robotic action spaces. To overcome this challenge, we propose to optimize adversarial prefixes based on continuous action representations, circumventing the discretization process. Additionally, we identify the beneficial impact of intermediate features on adversarial attacks and leverage the negative gradient of intermediate self-attention features to further enhance attack efficacy. Extensive experiments on VIMA models across 13 robot manipulation tasks validate the superiority of our method over existing approaches and demonstrate its transferability across different model variants.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
