网络相似性与对抗攻击可迁移性之间的关系
The Relationship Between Network Similarity and Transferability of Adversarial Attacks
AI总结：
本文研究网络相似性与对抗攻击可迁移性之间的关系，利用CKA相似度分数和DecisionTreeRegressor模型预测迁移攻击成功率，发现复杂网络更脆弱且预测准确率超90%。
摘要：
神经网络容易受到对抗攻击，目前已提出了几种防御方法。鉴于已开发出种类繁多的攻击手段，设计一个鲁棒的网络是一项具有挑战性的任务。因此，我们旨在深入探究网络相似性对迁移性对抗攻击成功率的影响。网络设计者随后可以通过将他们的新网络与现有网络进行比较，来估计其脆弱性。为了实现这一目标，我们研究了网络相似性与迁移性对抗攻击成功率之间的复杂关系。我们应用了中心化核对齐（CKA）网络相似度分数，并使用多种方法来寻找大量卷积神经网络（CNN）与对抗攻击之间的相关性。研究发现，不同CNN架构之间的网络相似性为中等程度，而像DenseNet这样更复杂的模型由于其架构复杂性，显示出较低的相似度分数。对于一致的基础层（如DataParallel、Dropout和Conv2d），层相似度最高，而专用层则显示出更大的变异性。对于非迁移攻击，对抗攻击的成功率通常是一致的，但对于某些迁移攻击则变化显著，其中复杂网络更为脆弱。我们发现，DecisionTreeRegressor能够预测所有黑盒攻击和Carlini & Wagner攻击的迁移攻击成功率，准确率超过90%，这表明预测模型在特定条件下可能是可行的。然而，不同数据子集之间结果的变异性凸显了这些关系的复杂性，并表明需要进一步的研究来将这些发现推广到不同的攻击场景和网络架构中。
英文摘要：
Neural networks are vulnerable to adversarial attacks, and several defenses have been proposed. Designing a robust network is a challenging task given the wide range of attacks that have been developed. Therefore, we aim to provide insight into the influence of network similarity on the success rate of transferred adversarial attacks. Network designers can then compare their new network with existing ones to estimate its vulnerability. To achieve this, we investigate the complex relationship between network similarity and the success rate of transferred adversarial attacks. We applied the Centered Kernel Alignment (CKA) network similarity score and used various methods to find a correlation between a large number of Convolutional Neural Networks (CNNs) and adversarial attacks. Network similarity was found to be moderate across different CNN architectures, with more complex models such as DenseNet showing lower similarity scores due to their architectural complexity. Layer similarity was highest for consistent, basic layers such as DataParallel, Dropout and Conv2d, while specialized layers showed greater variability. Adversarial attack success rates were generally consistent for non-transferred attacks, but varied significantly for some transferred attacks, with complex networks being more vulnerable. We found that a DecisionTreeRegressor can predict the success rate of transferred attacks for all black-box and Carlini & Wagner attacks with an accuracy of over 90%, suggesting that predictive models may be viable under certain conditions. However, the variability of results across different data subsets underscores the complexity of these relationships and suggests that further research is needed to generalize these findings across different attack scenarios and network architectures.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
