用于提升面部对抗样本可迁移性的注意力聚合攻击
Attention-aggregated Attack for Boosting the Transferability of Facial Adversarial Examples
AI总结：
本文针对人脸识别模型提出注意力聚合攻击（AAA），通过模仿其他模型的注意力来破坏关键面部特征，从而提升对抗样本在黑盒场景下的可迁移性。
摘要：
对抗样本揭示了深度学习模型的脆弱性，并引发了关于信息安全的严重担忧。基于迁移的攻击是黑盒攻击中的一个热点，适用于目标模型的训练数据集、参数和结构对攻击者未知的现实场景。然而，很少有方法考虑细粒度视觉任务中类别特定深度模型的特殊性，例如人脸识别（FR），导致攻击性能不尽如人意。在本工作中，我们首先研究了人脸中究竟是什么对FR模型的嵌入学习做出了贡献，并发现决定性面部特征和辅助性面部特征对于每个FR模型都是特定的，这与人类视觉系统的生物机制有很大不同。据此，我们随后提出了一种名为注意力聚合攻击（AAA）的新型攻击方法，以增强对抗样本针对FR的可迁移性，该方法受注意力分歧的启发，旨在通过模仿其他FR模型在干净人脸图像上的注意力，来破坏对其决策至关重要的面部特征。在各种FR模型上进行的大量实验验证了所提方法相对于现有方法的优越性和稳健有效性。
英文摘要：
Adversarial examples have revealed the vulnerability of deep learning models and raised serious concerns about information security. The transfer-based attack is a hot topic in black-box attacks that are practical to real-world scenarios where the training datasets, parameters, and structure of the target model are unknown to the attacker. However, few methods consider the particularity of class-specific deep models for fine-grained vision tasks, such as face recognition (FR), giving rise to unsatisfactory attacking performance. In this work, we first investigate what in a face exactly contributes to the embedding learning of FR models and find that both decisive and auxiliary facial features are specific to each FR model, which is quite different from the biological mechanism of human visual system. Accordingly we then propose a novel attack method named Attention-aggregated Attack (AAA) to enhance the transferability of adversarial examples against FR, which is inspired by the attention divergence and aims to destroy the facial features that are critical for the decision-making of other FR models by imitating their attentions on the clean face images. Extensive experiments conducted on various FR models validate the superiority and robust effectiveness of the proposed method over existing methods.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
