Adversarial examples (AEs) have been extensively studied due to their
potential for privacy protection and inspiring robust neural networks. However,
making a targeted AE transferable across unknown models remains challenging. In
this paper, to alleviate the overfitting dilemma common in an AE crafted by
existing simple iterative attacks, we propose fine-tuning it in the feature
space. Specifically, starting with an AE generated by a baseline attack, we
encourage the features that contribute to the target class and discourage the
features that contribute to the original class in a middle layer of the source
model. Extensive experiments demonstrate that only a few iterations of
fine-tuning can boost existing attacks in terms of targeted transferability
nontrivially and universally. Our results also verify that the simple iterative
attacks can yield comparable or even better transferability than the
resource-intensive methods, which rely on training target-specific classifiers
or generators with additional data. The code is available at:
github.com/zengh5/TA_feature_FT.

在这篇论文中，通过在特征空间进行微调，我们提出了一种解决针对未知模型的有针对性对抗样本（AE）传递性问题的方法，实验证明简单的迭代攻击可以产生与资源密集型方法相媲美甚至更好的传递效果。

通过特征空间微调提升有针对性的可迁移性

Enhancing targeted transferability via feature space fine-tuning

Achieving robustness against adversarial input perturbation is an important
and intriguing problem in machine learning. In the area of semantic image
segmentation, a number of adversarial training approaches have been proposed as
a defense against adversarial perturbation, but the methodology of evaluating
the robustness of the models is still lacking, compared to image
classification. Here, we demonstrate that, just like in image classification,
it is important to evaluate the models over several different and hard attacks.
We propose a set of gradient based iterative attacks and show that it is
essential to perform a large number of iterations. We include attacks against
the internal representations of the models as well. We apply two types of
attacks: maximizing the error with a bounded perturbation, and minimizing the
perturbation for a given level of error. Using this set of attacks, we show for
the first time that a number of models in previous work that are claimed to be
robust are in fact not robust at all. We then evaluate simple adversarial
training algorithms that produce reasonably robust models even under our set of
strong attacks. Our results indicate that a key design decision to achieve any
robustness is to use only adversarial examples during training. However, this
introduces a trade-off between robustness and accuracy.

该研究提出了一种基于梯度的迭代攻击方法来评估在语义图像分割领域中防御对抗扰动的模型的鲁棒性，并发现只有使用对抗样本进行训练才能获得鲁棒性，并分析了鲁棒性和准确性之间的权衡。

评估语义分割模型的对抗鲁棒性

On Evaluating the Adversarial Robustness of Semantic Segmentation Models

Injecting adversarial examples during training, known as adversarial
training, can improve robustness against one-step attacks, but not for unknown
iterative attacks. To address this challenge, we first show iteratively
generated adversarial images easily transfer between networks trained with the
same strategy. Inspired by this observation, we propose cascade adversarial
training, which transfers the knowledge of the end results of adversarial
training. We train a network from scratch by injecting iteratively generated
adversarial images crafted from already defended networks in addition to
one-step adversarial images from the network being trained. We also propose to
utilize embedding space for both classification and low-level (pixel-level)
similarity learning to ignore unknown pixel level perturbation. During
training, we inject adversarial images without replacing their corresponding
clean images and penalize the distance between the two embeddings (clean and
adversarial). Experimental results show that cascade adversarial training
together with our proposed low-level similarity learning efficiently enhances
the robustness against iterative attacks, but at the expense of decreased
robustness against one-step attacks. We show that combining those two
techniques can also improve robustness under the worst case black box attack
scenario.

本文介绍了一种级联对抗训练的方法，它利用嵌入空间进行分类和低层次相似性学习，能有效提高对迭代攻击的鲁棒性，但有可能导致对一步攻击的鲁棒性下降，并证明了将这两种技术相结合可以改善情况最劣的黑盒攻击场景下的鲁棒性。