超越欺骗性平坦：增强对抗迁移性的双阶解法
Beyond Deceptive Flatness: Dual-Order Solution for Strengthening Adversarial Transferability
AI总结：
针对欺骗性平坦导致对抗迁移性次优的问题，提出基于双阶信息的AFA攻击与MCAS采样方法，有效提升对抗样本在未知模型及API上的迁移能力。
摘要：
可迁移攻击在替代模型上生成对抗样本以愚弄未知的受害模型，构成了现实世界的威胁并引起了越来越多的研究兴趣。尽管近期研究关注可迁移对抗样本的平坦损失，但仍会陷入次优区域，尤其是平坦却尖锐的区域，即欺骗性平坦。本文从双阶信息的视角引入了一种新颖的基于梯度的黑盒可迁移攻击。具体而言，我们针对欺骗性平坦问题可行地提出了Adversarial Flatness (AF)（对抗平坦性），并提供了对抗迁移性的理论保证。在此基础上，利用目标函数的高效近似，我们将攻击实例化为Adversarial Flatness Attack (AFA)（对抗平坦性攻击），解决了梯度符号改变的问题。此外，为进一步提升攻击能力，我们通过提升内循环采样效率设计了MonteCarlo Adversarial Sampling (MCAS)（蒙特卡洛对抗采样）。在ImageNet-compatible数据集上的综合结果证明了其优于六个基线，能在更平坦区域生成对抗样本并提升跨模型架构的迁移性。在输入变换攻击或Baidu Cloud API测试中，我们的方法均优于基线。
英文摘要：
Transferable attacks generate adversarial examples on surrogate models to fool unknown victim models, posing real-world threats and growing research interest. Despite focusing on flat losses for transferable adversarial examples, recent studies still fall into suboptimal regions, especially the flat-yet-sharp areas, termed as deceptive flatness. In this paper, we introduce a novel black-box gradient-based transferable attack from a perspective of dual-order information. Specifically, we feasibly propose Adversarial Flatness (AF) to the deceptive flatness problem and a theoretical assurance for adversarial transferability. Based on this, using an efficient approximation of our objective, we instantiate our attack as Adversarial Flatness Attack (AFA), addressing the altered gradient sign issue. Additionally, to further improve the attack ability, we devise MonteCarlo Adversarial Sampling (MCAS) by enhancing the inner-loop sampling efficiency. The comprehensive results on ImageNet-compatible dataset demonstrate superiority over six baselines, generating adversarial examples in flatter regions and boosting transferability across model architectures. When tested on input transformation attacks or the Baidu Cloud API, our method outperforms baselines.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
