论文标题
调查顶级$ K $白色盒子和可转让的黑盒攻击
Investigating Top-$k$ White-Box and Transferable Black-box Attack
论文作者
论文摘要
现有作品已经确定了最高$ 1 $攻击成功率（ASR）的局限性，以评估攻击强度，但在白色盒子环境中专门研究了攻击强度，而我们的工作将其扩展到了更实用的黑盒子设置：可转移的攻击。据广泛报道，I-FGSM的强大转移比简单的FGSM差，这导致人们普遍认为可转移性与白色盒子攻击强度不符。我们的工作挑战了这种信念，即经验发现，在攻击后，利息类等级（ICR）指示的一般顶级$ K $ ASR实际上更强烈的攻击实际上会更好地转移。为了提高攻击强度，从几何学角度对logit梯度的直观解释，我们确定常用损失的弱点在于优先考虑愚弄网络而不是最大化其强度的速度。为此，我们提出了一种新的归一化CE损失，该损失指导logit以隐式最大化其与地面真实类别的级别距离的方向进行更新。各种环境中的广泛结果证明了我们提出的新损失对顶级$ K $攻击既简单又有效。代码可在：\ url {https://bit.ly/3uciomp}中获得。
Existing works have identified the limitation of top-$1$ attack success rate (ASR) as a metric to evaluate the attack strength but exclusively investigated it in the white-box setting, while our work extends it to a more practical black-box setting: transferable attack. It is widely reported that stronger I-FGSM transfers worse than simple FGSM, leading to a popular belief that transferability is at odds with the white-box attack strength. Our work challenges this belief with empirical finding that stronger attack actually transfers better for the general top-$k$ ASR indicated by the interest class rank (ICR) after attack. For increasing the attack strength, with an intuitive interpretation of the logit gradient from the geometric perspective, we identify that the weakness of the commonly used losses lie in prioritizing the speed to fool the network instead of maximizing its strength. To this end, we propose a new normalized CE loss that guides the logit to be updated in the direction of implicitly maximizing its rank distance from the ground-truth class. Extensive results in various settings have verified that our proposed new loss is simple yet effective for top-$k$ attack. Code is available at: \url{https://bit.ly/3uCiomP}
