论文标题
在黑盒攻击中朝着视觉失真
Towards Visual Distortion in Black-Box Attacks
论文作者
论文摘要
在黑盒威胁模型中构建对抗性示例通过引入视觉失真会伤害原始图像。在本文中，我们提出了一种新型的黑盒攻击方法，该方法可以通过学习对抗性示例的噪声分布直接最大程度地减少诱导的失真，假设仅损失轨道对黑盒网络的访问。量化的视觉失真是在我们的损失中引入了对抗性示例和原始图像之间的感知距离的，而从学习的噪声分布中抽样噪声来近似相应的非差异损耗函数的梯度。我们验证了对成像网的攻击的有效性。与最先进的Black-Box攻击相比，我们的攻击会导致失真得多，并且在InceptionV3，Resnet50和VGG160亿美元上达到了100美元的成功率。该代码可在https://github.com/alina-1997/visual-distortial-in-intack上找到。
Constructing adversarial examples in a black-box threat model injures the original images by introducing visual distortion. In this paper, we propose a novel black-box attack approach that can directly minimize the induced distortion by learning the noise distribution of the adversarial example, assuming only loss-oracle access to the black-box network. The quantified visual distortion, which measures the perceptual distance between the adversarial example and the original image, is introduced in our loss whilst the gradient of the corresponding non-differentiable loss function is approximated by sampling noise from the learned noise distribution. We validate the effectiveness of our attack on ImageNet. Our attack results in much lower distortion when compared to the state-of-the-art black-box attacks and achieves $100\%$ success rate on InceptionV3, ResNet50 and VGG16bn. The code is available at https://github.com/Alina-1997/visual-distortion-in-attack.
