发表机构
University of California, Berkeley（加州大学伯克利分校）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
ATLAS提出基于主动学习的自适应信赖域框架，通过水平集估计和局部-全局采样高效发现黑盒模型的对抗输入集，在多个基准上优于现有查询型攻击方法。
AI 中文摘要
对基于学习系统的安全性评估，不仅仅需要针对固定攻击集合测试系统，还需要自适应机制，能够高效发现导致模型失败的输入集合。我们提出了ATLAS（潜在对抗搜索的自适应信赖域），这是一个基于查询的框架，用于发现黑盒学习系统的对抗输入集。ATLAS将攻击生成视为主动学习水平集估计问题，然后将校准近似与局部-全局采样架构相结合，以找到包含对抗样本的输入空间区域。一旦发现这些区域，ATLAS设计为在这些对抗区域内采样点，构建能够准确表示目标模型鲁棒性状态的对抗集。在玩具实验上应用时，我们发现ATLAS在有限查询预算下比先前工作能够恢复更多的对抗区域。当应用于标准和对抗训练的MNIST、CIFAR和ImageNet模型目标时，ATLAS比其他基于查询的黑盒攻击（NES、SignHunter、BayesOpt）产生更好的代表性攻击。ATLAS代表了一种自动化红队框架，可用于分析开发中基于学习系统的鲁棒性，以及持续审计以观察系统鲁棒性随时间的变化。
英文摘要
Security evaluation of learning-based systems requires more than just testing the system against a fixed collection of attacks. It requires adaptive mechanisms that can efficiently discover \textit{sets} of inputs that induce model failure. We introduce ATLAS (Adaptive Trust-Regions for Latent Adversarial Searches), which is a query-based framework that discovers adversarial input sets for black-box learning systems. ATLAS casts attack generation as an active learning level set estimation problem then combines calibrated approximations with a local-global sampling architecture to find regions of the input space that contain adversarial examples. Once discovered, ATLAS is designed to sample points within these adversarial regions to build adversarial sets that accurately represent the state of robustness of the target model. When applied on toy experiments, we find that ATLAS is able to recover more of the adversarial region under a limited query budget than does previous work. When applied to standard and adversarially trained MNIST, CIFAR, and ImageNet model targets, ATLAS produces better representative attacks than other query-based black-box attacks (NES, SignHunter, BayesOpt). ATLAS represents an automated red-teaming framework that can be used for both analyzing the robustness of learning-based systems under development and continuous auditing to see how the robustness of a system changes over time.
Comments9 pages main body, plus 10 additional pages for references and appendix
