论文标题
复合对抗性攻击
Composite Adversarial Attacks
论文作者
论文摘要
对抗攻击是一种欺骗机器学习（ML）模型的技术，它提供了一种评估对抗性鲁棒性的方法。实际上，攻击算法是由人工选择和调整人类专家以破坏ML系统的。但是，攻击者的手动选择往往是最佳选择，导致对模型安全性的错误评估。在本文中，提出了一种称为复合对抗攻击（CAA）的新程序，以自动从\ textbf {32基本攻击者}的候选库中自动搜索攻击算法及其超参数的最佳组合。我们设计了一个搜索空间，其中攻击策略表示为攻击序列，即，以前的攻击者的输出用作后继者的初始化输入。采用多目标NSGA-II遗传算法来找到最大的攻击政策，并具有最小的复杂性。实验结果表明，CAA在11个不同的防御措施中以较少的时间（\ textbf {6 $ \ times $ $ $均比自动攻击}快击败了10位顶级攻击者），并在$ l _ {\ infty} $，$ l_ {2} $ and $ l_ {2} $ and intrestrift totredrestional攻击方面实现了新的先进的攻击。
Adversarial attack is a technique for deceiving Machine Learning (ML) models, which provides a way to evaluate the adversarial robustness. In practice, attack algorithms are artificially selected and tuned by human experts to break a ML system. However, manual selection of attackers tends to be sub-optimal, leading to a mistakenly assessment of model security. In this paper, a new procedure called Composite Adversarial Attack (CAA) is proposed for automatically searching the best combination of attack algorithms and their hyper-parameters from a candidate pool of \textbf{32 base attackers}. We design a search space where attack policy is represented as an attacking sequence, i.e., the output of the previous attacker is used as the initialization input for successors. Multi-objective NSGA-II genetic algorithm is adopted for finding the strongest attack policy with minimum complexity. The experimental result shows CAA beats 10 top attackers on 11 diverse defenses with less elapsed time (\textbf{6 $\times$ faster than AutoAttack}), and achieves the new state-of-the-art on $l_{\infty}$, $l_{2}$ and unrestricted adversarial attacks.
