Deep neural networks are vulnerable to adversarial examples, which attach human invisible perturbations to benign inputs. Simultaneously, adversarial examples exhibit transferability under different models, which makes practical black-box attacks feasible. However, existing methods are still incapable of achieving desired transfer attack performance. In this work, from the perspective of gradient optimization and consistency, we analyze and discover the gradient elimination phenomenon as well as the local momentum optimum dilemma. To tackle these issues, we propose Global Momentum Initialization (GI) to suppress gradient elimination and help search for the global optimum. Specifically, we perform gradient pre-convergence before the attack and carry out a global search during the pre-convergence stage. Our method can be easily combined with almost all existing transfer methods, and we improve the success rate of transfer attacks significantly by an average of 6.4% under various advanced defense mechanisms compared to state-of-the-art methods. Eventually, we achieve an attack success rate of 95.4%, fully illustrating the insecurity of existing defense mechanisms.
翻译:深神经网络很容易受到对抗性的例子的影响,这些例子将人类看不见的扰动附在良性投入上。同时,对抗性的例子在不同的模型下显示出可转移性,使得实际的黑箱攻击成为可行。然而,现有的方法仍然无法达到预期的转移攻击性能。在这项工作中,从梯度优化和一致性的角度,我们分析并发现梯度消除现象以及当地动力的最佳困境。为了解决这些问题,我们提议全球动力初始化(GI)来抑制梯度的消除,并帮助寻找全球最佳的方法。具体地说,我们在攻击前进行梯度趋同前的预变异,并在趋同前的阶段进行全球搜索。我们的方法可以很容易地与几乎所有现有的转移方法结合起来,我们大大提高各种先进防御机制下转移攻击的成功率,与最先进的方法相比,平均为6.4%。最后,我们取得了95.4%的攻击成功率,这充分说明现有防御机制的不安全性。