论文标题
跨越攻击：使用未标记的数据加强黑框攻击
Spanning Attack: Reinforce Black-box Attacks with Unlabeled Data
论文作者
论文摘要
对抗性黑盒攻击旨在通过查询机器学习模型的输入输出对来制作对抗性扰动。它们被广泛用于评估预训练模型的鲁棒性。但是，由于输入空间的高维度，黑盒攻击通常会遭受查询效率低下的问题，因此会产生一种错误的模型鲁棒性感。在本文中，我们放松了黑盒威胁模型的条件，并提出了一种称为“生成攻击”的新技术。通过跨越辅助未标记的数据集在低维子空间中限制对抗性扰动，跨度攻击可显着提高各种现有的黑盒攻击的查询效率。广泛的实验表明，该提出的方法在软标签和硬标签黑盒攻击中都可以很好地工作。我们的代码可在https://github.com/wangwllu/spanning_attack上找到。
Adversarial black-box attacks aim to craft adversarial perturbations by querying input-output pairs of machine learning models. They are widely used to evaluate the robustness of pre-trained models. However, black-box attacks often suffer from the issue of query inefficiency due to the high dimensionality of the input space, and therefore incur a false sense of model robustness. In this paper, we relax the conditions of the black-box threat model, and propose a novel technique called the spanning attack. By constraining adversarial perturbations in a low-dimensional subspace via spanning an auxiliary unlabeled dataset, the spanning attack significantly improves the query efficiency of a wide variety of existing black-box attacks. Extensive experiments show that the proposed method works favorably in both soft-label and hard-label black-box attacks. Our code is available at https://github.com/wangwllu/spanning_attack.
