GuidedRay：面向目标硬标签黑盒攻击的多样性引导方向发现
GuidedRay: Diversity-Guided Direction Discovery for Targeted Hard-Label Black-Box Attacks
浏览论文内容
中文总结 AI 辅助
GuidedRay提出多样性引导的方向发现方法，用于目标硬标签黑盒攻击，通过参考样本生成多样候选并快速筛选，在多个数据集和查询预算下优于现有方法。
中文摘要 AI 辅助
深度神经网络容易受到对抗性攻击。在黑盒攻击中，目标决策型攻击尤为困难：攻击者仅能观察到目标模型的top-1标签，并旨在有界扰动下使其预测一个预先指定的目标类别。在扰动细化之前，攻击者必须发现一个能到达指定目标区域的方向。这一初始化步骤可能产生大量查询开销。我们提出GuidedRay，一种基于多样性引导方向发现的目标决策型攻击。GuidedRay基于两个观察：目标类参考样本提供了有用的目标条件方向先验，且多样化的候选者增加了发现目标对抗方向的可能性。GuidedRay从一个或多个目标类参考生成多样化候选者，并使用一次查询的快速测试来筛选其诱导的符号方向。一旦找到可行方向，GuidedRay应用射线搜索来减小其决策边界半径。在CIFAR-10、CIFAR-100和ImageNet上的实验表明，GuidedRay在从500到5000的四个评估查询预算下始终优于五种最先进的决策型攻击，在初始化阶段的方向发现中尤其显著。对于受对抗训练或TRADES保护的模型，它在所有四个查询预算下同样实现了最高的攻击成功率。
英文摘要
Deep neural networks are vulnerable to adversarial attacks. Among black-box attacks, targeted decision-based attacks are particularly difficult: the attacker observes only the target model's top-1 label and aims to make it predict a prespecified target class under a bounded perturbation. Before perturbation refinement, the attacker must discover a direction that reaches the prescribed target region. This initialization step can incur substantial query cost. We propose GuidedRay, a targeted decision-based attack based on diversity-guided direction discovery. GuidedRay builds on two observations: target-class reference samples provide useful target-conditioned direction priors, and diverse candidates increase the probability of discovering a targeted adversarial direction. GuidedRay generates varied candidates from one or multiple target-class references and uses a one-query Fast Test to screen their induced sign directions. Once a feasible direction is found, GuidedRay applies Ray Search to reduce its decision-boundary radius. Experiments on CIFAR-10, CIFAR-100, and ImageNet demonstrate that GuidedRay consistently outperforms five state-of-the-art decision-based attacks at four evaluated query budgets from 500 to 5,000, with particularly pronounced gains in direction discovery during initialization. Against models protected by adversarial training or TRADES, it likewise achieves the highest attack success rate at all four query budgets.
发表机构
- Shandong University（山东大学）
- Tsinghua University（清华大学）
- Institute of Satellite Information Engineering（卫星信息工程研究所）
- Illinois Institute of Technology（伊利诺伊理工学院）
机构由 AI 辅助整理，请以论文原文为准。
