论文标题
通过元学习来增强黑盒对抗攻击
Boosting Black-Box Adversarial Attacks with Meta Learning
论文作者
论文摘要
深度神经网络（DNNS）在不同领域取得了巨大的成功。但是，已经证明，即使在黑色盒子设置中，DNN也非常容易受到对抗示例的影响。文献中已经提出了大量的黑盒攻击方法。但是，这些方法通常会遭受成功率低和大量查询计数的困扰，这无法完全满足实际目的。在本文中，我们提出了一种混合攻击方法，该方法在替代模型上训练元对对抗扰动（地图），并通过估计模型的梯度来执行黑盒攻击。我们的方法使用元对逆动力作为初始化，随后训练几个时期的任何黑盒攻击方法。此外，这些地图享有有利的可传递性和普遍性，从某种意义上说，它们可以用来提高其他黑盒对抗攻击方法的性能。广泛的实验表明，与其他方法相比，我们的方法不仅可以提高攻击成功率，而且可以减少查询数量。
Deep neural networks (DNNs) have achieved remarkable success in diverse fields. However, it has been demonstrated that DNNs are very vulnerable to adversarial examples even in black-box settings. A large number of black-box attack methods have been proposed to in the literature. However, those methods usually suffer from low success rates and large query counts, which cannot fully satisfy practical purposes. In this paper, we propose a hybrid attack method which trains meta adversarial perturbations (MAPs) on surrogate models and performs black-box attacks by estimating gradients of the models. Our method uses the meta adversarial perturbation as an initialization and subsequently trains any black-box attack method for several epochs. Furthermore, the MAPs enjoy favorable transferability and universality, in the sense that they can be employed to boost performance of other black-box adversarial attack methods. Extensive experiments demonstrate that our method can not only improve the attack success rates, but also reduces the number of queries compared to other methods.
