论文标题
通过模型架构增强对抗性示例的可传递性
Enhance transferability of adversarial examples with model architecture
论文作者
论文摘要
对抗性示例的可传递性对于发射黑框对抗攻击至关重要，在该攻击者中只允许攻击者访问目标模型的输出。但是，在如此具有挑战性但实用的环境下，精心制作的对抗性例子总是容易过度适合所采用的代理模型，表现出差的可传递性。在本文中，我们建议从新颖的角度来减轻过度拟合的问题，即设计合适的模型体系结构。具体而言，我们可以说，我们可以说将现有模型体系结构分解为有效的模型体系结构，即多轨模型体系结构（MMA）。在MMA上制作的对抗性示例可以极大地减轻模型指定特征的影响，并朝着不同体系结构采用的脆弱方向。广泛的实验评估表明，基于MMA的对抗示例的可传递性可显着超过其他最先进的模型体系结构，高达40％，而开销可比。
Transferability of adversarial examples is of critical importance to launch black-box adversarial attacks, where attackers are only allowed to access the output of the target model. However, under such a challenging but practical setting, the crafted adversarial examples are always prone to overfitting to the proxy model employed, presenting poor transferability. In this paper, we suggest alleviating the overfitting issue from a novel perspective, i.e., designing a fitted model architecture. Specifically, delving the bottom of the cause of poor transferability, we arguably decompose and reconstruct the existing model architecture into an effective model architecture, namely multi-track model architecture (MMA). The adversarial examples crafted on the MMA can maximumly relieve the effect of model-specified features to it and toward the vulnerable directions adopted by diverse architectures. Extensive experimental evaluation demonstrates that the transferability of adversarial examples based on the MMA significantly surpass other state-of-the-art model architectures by up to 40% with comparable overhead.
