Cross-Modal Transferable Image-to-Video Attack on Video Quality Metrics
Lomonosov Moscow State University（罗蒙诺索夫莫斯科国立大学）；ISP RAS Research Center for Trusted Artificial Intelligence（俄罗斯科学院信息与系统研究所在可信人工智能研究中心）；MSU Institute for Artificial Intelligence（莫斯科大学人工智能研究所）；Laboratory of Innovative Technologies for Processing Video Content（视频内容处理创新技术实验室）
Georgii Gotin, Ekaterina Shumitskaya, Anastasia Antsiferova, Dmitriy Vatolin
Recent studies have revealed that modern image and video quality assessment (IQA/VQA) metrics are vulnerable to adversarial attacks. An attacker can manipulate a video through preprocessing to artificially increase its quality score according to a certain metric, despite no actual improvement in visual quality. Most of the attacks studied in the literature are white-box attacks, while black-box attacks in the context of VQA have received less attention. Moreover, some research indicates a lack of transferability of adversarial examples generated for one model to another when applied to VQA. In this paper, we propose a cross-modal attack method, IC2VQA, aimed at exploring the vulnerabilities of modern VQA models. This approach is motivated by the observation that the low-level feature spaces of images and videos are similar. We investigate the transferability of adversarial perturbations across different modalities; specifically, we analyze how adversarial perturbations generated on a white-box IQA model with an additional CLIP module can effectively target a VQA model. The addition of the CLIP module serves as a valuable aid in increasing transferability, as the CLIP model is known for its effective capture of low-level semantics. Extensive experiments demonstrate that IC2VQA achieves a high success rate in attacking three black-box VQA models. We compare our method with existing black-box attack strategies, highlighting its superiority in terms of attack success within the same number of iterations and levels of attack strength. We believe that the proposed method will contribute to the deeper analysis of robust VQA metrics.
When Robots Obey the Patch: Universal Transferable Patch Attacks on Vision-Language-Action Models
ROSE Lab, Interdisciplinary Graduate Programme, Nanyang Technological University（罗思实验室，跨学科研究生项目，南洋理工大学）；ROSE Lab, School of Electrical and Electronic Engineering, Nanyang Technological University（罗思实验室，电子与电气工程学院，南洋理工大学）；CCDS, Nanyang Technological University（CCDS，南洋理工大学）；DSO National Laboratories（国防科学局实验室）
Towards Transferable Adversarial Attacks on Vision Transformers
Shanghai Key Lab of Intelligent Information Processing, School of Computer Science, Fudan University（复旦大学计算机科学技术学院上海市智能信息处理重点实验室）；Shanghai Collaborative Innovation Center on Intelligent Visual Computing（上海智能视觉计算协同创新中心）；Department of Computer Science, University of Maryland（马里兰大学计算机科学系）
Visual-Invariance-Augmented Feature Optimal Alignment for Transferable Adversarial Attacks against Closed-Source MLLMs
Nanyang Technological University（南洋理工大学）；Northeastern University（东北大学）；Chongqing University（重庆大学）；University of Chinese Academy of Sciences（中国科学院大学）；Sun Yat-sen University（中山大学）
CLIP-Guided Generative Networks for Transferable Targeted Adversarial Attacks
Tsinghua Shenzhen International Graduate School, Tsinghua University（清华大学深圳国际研究生院）；Harbin Institute of Technology, Shenzhen（哈尔滨工业大学（深圳））；Pengcheng Laboratory（鹏城实验室）；Shenzhen University（深圳大学）；Shenzhen Digital Certificate Authority CO., Ltd（深圳数字证书认证中心有限公司）
Towards Transferable Targeted 3D Adversarial Attack in the Physical World
Institute of Artificial Intelligence, Beihang University（北京航空航天大学人工智能学院）；RealAI；Tsinghua-Bosch Joint ML Center（清华博世联合机器学习中心）；BNRist Center, Tsinghua University（清华大学BNRist中心）
Transferable Adversarial Attack based on Integrated Gradients
Nanyang Technological University（南洋理工大学）
深度神经网络对对抗性样本的脆弱性引起了社区的极大关注。三种方法，优化标准目标函数，利用注意力地图和平滑决策表面，通常用于制作对抗性示例。通过将这三种方法紧密结合，本文提出了一种新的简单算法TAIG（Transferable Attack based on Integrated Concentrants），该算法能够发现高可转移性的对抗性黑盒攻击样本。与以往的方法使用多个计算项或与其他方法相结合，TAIG集成了三种方法到一个单一的术语。两个版本的TAIG计算其积分梯度的直线路径和随机分段线性路径进行了研究。这两个版本都提供了很强的可移植性，并且可以与以前的方法无缝地协同工作。实验结果表明，TAIG优于国家的最先进的方法。该代码将在https://github.com/yihuang2016/TAIG上提供
Transferable Adversarial Attack on Image Tampering Localization
Communication University of China（中国传媒大学）；State Key Laboratory of Media Convergence and Communication, Communication University of China（中国传媒大学媒体融合与传播国家重点实验室）；School of Computer and Cyber Sciences, Communication University of China（中国传媒大学计算机与网络空间安全学院）
Towards Highly Transferable Vision-Language Attack via Semantic-Augmented Dynamic Contrastive Interaction
School of Artificial Intelligence and Computer Science, Jiangnan University（江南大学人工智能与计算机科学学院）；Centre for Vision, Speech and Signal Processing (CVSSP), University of Surrey（Surrey 大学视觉、语音和信号处理中心）
Model Mimic Attack: Knowledge Distillation for Provably Transferable Adversarial Examples
Research Center for Trusted Artificial Intelligence（可信人工智能研究中心）；Ivannikov Institute for System Programming of the Russian Academy of Sciences（俄罗斯科学院伊万尼科夫系统编程研究所）；Moscow Institute of Physics and Technology (National Research University)（莫斯科物理技术学院（国立研究型大学））；AIRI（AIRI（人工智能研究所））
One Attack to Fool Them All: Highly Transferable Black-Box Adversarial Attacks on Frontier MLLMs
State Key Laboratory of AI Safety, Institute of Computing Technology, Chinese Academy of Sciences（中国科学院计算技术研究所人工智能安全国家重点实验室）；University of Chinese Academy of Sciences（中国科学院大学）
Switching Transferable Gradient Directions for Query-Efficient Black-Box Adversarial Attacks
School of Software, BNRist, Tsinghua University（清华大学软件学院、北京信息科学与技术国家研究中心（BNRist））；Dept. of Comp. Sci. and Tech., BNRist Center, Institute for AI, THBI Lab, Tsinghua University（清华大学计算机科学与技术系、北京信息科学与技术国家研究中心（BNRist）中心、人工智能研究院、THBI实验室）
Sparse and Transferable Universal Singular Vectors Attack
Sber AI Lab（Sber AI实验室）；Skolkovo Institute of Science and Technology（斯科尔科沃科学技术学院）；Moscow Institute of Physics and Technology（莫斯科物理技术学院）；Artificial Intelligence Research Institute (AIRI)（人工智能研究院（AIRI））
Exploiting Edge Features for Transferable Adversarial Attacks in Distributed Machine Learning
Department of Excellence in Robotics and AI, TeCIP, Scuola Superiore Sant'Anna（机器人与人工智能卓越部门，TeCIP，圣安娜高等学院）；Department of Electrical and Electronic Engineering, University of Cagliari（电气与电子工程系，卡利亚里大学）
Transferable Dual-Domain Feature Importance Attack against AI-Generated Image Detector
School of Computer and Cyber Sciences, Communication University of China（通信大学计算机与电子科学学院）；State Key Laboratory of Media Convergence and Communication, Communication University of China（通信大学媒体融合与传播国家重点实验室）；School of Computer Science and Engineering, Hunan University of Information Technology（湖南信息科技学院计算机科学与工程学院）；Department of Information Engineering, Beijing Institute of Graphic Communication（北京印刷学院信息工程系）；Fujian Provincial Key Laboratory of Big Data Mining and Applications, Fujian University of Technology（福建科技学院大数据挖掘与应用省级重点实验室）
Towards Transferable Unrestricted Adversarial Examples with Minimum Changes
Peking University（北京大学）；University of Waterloo（滑铁卢大学）
基于转移的对抗示例是最重要的一类黑盒攻击。然而，在对抗性扰动的可转移性和不可感知性之间存在权衡。在这个方向上的先前工作通常需要固定但大的$\ell_p$范数扰动预算以达到良好的传输成功率，从而导致可感知的对抗性扰动。另一方面，目前大多数旨在生成语义保持扰动的无限制对抗攻击都存在向目标模型的可转移性较弱的问题。在这项工作中，我们提出了一个几何感知框架，以生成具有最小变化的可转移对抗性示例。类似于统计机器学习中的模型选择，我们利用验证模型来选择$\ell_{\infty}$范数和无限制威胁模型下每个图像的最佳扰动预算。我们提出了一种原则性的方法，通过鼓励组内多样性，同时惩罚组外相似性来划分训练和验证模型。大量实验验证了我们的框架在平衡精心制作的对抗性示例的不可感知性和可移植性方面的有效性。该方法是我们参加CVPR'21 Security AI Challenger的基础：ImageNet上的无限制对抗攻击，我们在1，559个团队中排名第一，并在最终得分和平均图像质量水平方面分别超过亚军4.59%和23.91%。代码可在https://github.com/Equationliu/GA-Attack上获得。
Institute for Infocomm Research, Agency for Science, Technology, and Research (A*STAR)（新加坡科技研究局信息通信研究院）；National University of Singapore（新加坡国立大学）；University of California Riverside（加州大学河滨分校）；Shenzhen Research Institute of Big Data, The Chinese University of Hong Kong（香港中文大学（深圳）深圳大数据研究院）
Doppelganger Method: Breaking Role Consistency in LLM Agent via Prompt-based Transferable Adversarial Attack
Research Institute for Future Medicine, Samsung Medical Center（未来医学研究所，三星医疗中心）；Department of Digital Health, SAIHST, Sungkyunkwan University（数字健康系，SAIHST，成均馆大学）；Department of Medical Device Management and Research, SAIHST, Sungkyunkwan University（医疗设备管理与研究系，SAIHST，成均馆大学）；Department of Emergency Medicine, Samsung Medical Center（急诊医学系，三星医疗中心）
DP-TRAE: A Dual-Phase Merging Transferable Reversible Adversarial Example for Image Privacy Protection
School of Computer and Information Engineering, Xiamen University of Technology（厦门理工大学计算机与信息工程学院）；School of Computer Science, Engineering Research Center of Machine Learning and Industry Intelligence, Sichuan University（四川大学计算机科学学院，机器学习与产业智能工程研究中心）；Department of Computer and Information Science, Faculty of Science and Technology, University of Macau（澳门大学科学与技术学院计算机与信息科学系）；Department of Electrical and Electronic Engineering, University of Hong Kong（香港大学电子与电气工程系）；Institute of Space Internet, Fudan University（复旦大学空间互联网研究所）；School of Computer Science and Engineering, Nanyang Technological University（南洋理工大学计算机科学与工程学院）
Strong Transferable Adversarial Attacks via Ensembled Asymptotically Normal Distribution Learning
School of Computer Science and Technology, Beijing Jiaotong University（北京交通大学计算机科学与技术学院）；Collaborative Innovation Center of Railway Traffic Safety（轨道交通安全协同创新中心）
