通过量化共享特征表征预测基于迁移的攻击的成功率
Towards Predicting the Success of Transfer-based Attacks by Quantifying Shared Feature Representations
AI总结：
本研究提出一种通过量化共享特征表征预测基于迁移的攻击（TBA）成功率的方法，验证了公共流形空间假设，发现共享特征与TBA成功率中等相关，可在无模型内部信息时预测攻击迁移性。
摘要：
目前已有大量研究致力于解释并提升针对黑盒计算机视觉模型的基于迁移的攻击（TBA）的成功率。本研究首次尝试通过识别目标模型中脆弱特征的存在，对攻击成功率进行先验预测。Chen与Liu（2024）近期的工作提出了流形攻击模型，这是一个统一框架，认为成功的TBA存在于公共流形空间中。本研究通过一种新方法对公共流形空间假设进行了实验验证：首先，将在ImageNet上训练的替代模型与目标模型的特征提取器输出的特征向量投影到同一个低维流形上；其次，量化流形上观测到的所有结构相似性；最后，将这些观测到的相似性与TBA的成功率关联起来。研究发现，共享特征表征与TBA成功率的提升呈中等相关性（ρ=0.56）。该方法可用于在无需模型权重、训练过程、架构或攻击细节信息的情况下，预测攻击是否能够迁移。研究结果证实了两个不同规模与复杂度的特征提取器之间存在共享特征表征，并证明了来自不同目标域的数据集可作为测试信号，用于解释黑盒特征表征。
英文摘要：
Much effort has been made to explain and improve the success of transfer-based attacks (TBA) on black-box computer vision models. This work provides the first attempt at a priori prediction of attack success by identifying the presence of vulnerable features within target models. Recent work by Chen and Liu (2024) proposed the manifold attack model, a unifying framework proposing that successful TBA exist in a common manifold space. Our work experimentally tests the common manifold space hypothesis by a new methodology: first, projecting feature vectors from surrogate and target feature extractors trained on ImageNet onto the same low-dimensional manifold; second, quantifying any observed structure similarities on the manifold; and finally, by relating these observed similarities to the success of the TBA. We find that shared feature representation moderately correlates with increased success of TBA (\r{ho}= 0.56). This method may be used to predict whether an attack will transfer without information of the model weights, training, architecture or details of the attack. The results confirm the presence of shared feature representations between two feature extractors of different sizes and complexities, and demonstrate the utility of datasets from different target domains as test signals for interpreting black-box feature representations.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
