This paper aims to enhance the transferability of adversarial samples in
targeted attacks, where attack success rates remain comparatively low. To
achieve this objective, we propose two distinct techniques for improving the
targeted transferability from the loss and feature aspects. First, in previous
approaches, logit calibrations used in targeted attacks primarily focus on the
logit margin between the targeted class and the untargeted classes among
samples, neglecting the standard deviation of the logit. In contrast, we
introduce a new normalized logit calibration method that jointly considers the
logit margin and the standard deviation of logits. This approach effectively
calibrates the logits, enhancing the targeted transferability. Second, previous
studies have demonstrated that mixing the features of clean samples during
optimization can significantly increase transferability. Building upon this, we
further investigate a truncated feature mixing method to reduce the impact of
the source training model, resulting in additional improvements. The truncated
feature is determined by removing the Rank-1 feature associated with the
largest singular value decomposed from the high-level convolutional layers of
the clean sample. Extensive experiments conducted on the ImageNet-Compatible
and CIFAR-10 datasets demonstrate the individual and mutual benefits of our
proposed two components, which outperform the state-of-the-art methods by a
large margin in black-box targeted attacks.

本文旨在提高有针对性攻击中对抗样本的可转移性，通过在损失和特征方面提出两种不同的改进方法。首先，我们引入了一种新的规范化对数准确度校准方法，它同时考虑了对数边界和对数的标准差。其次，我们进一步研究了截断特征混合方法来减小源训练模型的影响，从而实现了额外的改进。在 ImageNet-Compatible 和 CIFAR-10 数据集上进行的实验证明了我们提出的两个组件的个别和相互优势，在黑盒有针对性攻击中取得了领先于现有方法的大幅度改进。

通过标准化逻辑输出校准和截断特征混合改进可转移的有针对性对抗攻击

Improving Transferable Targeted Adversarial Attack via Normalized Logit  Calibration and Truncated Feature Mixing

Federated learning (FL) is a privacy-preserving distributed framework for
collaborative model training on devices in edge networks. However, challenges
arise due to vulnerability to adversarial examples (AEs) and the
non-independent and identically distributed (non-IID) nature of data
distribution among devices, hindering the deployment of adversarially robust
and accurate learning models at the edge. While adversarial training (AT) is
commonly acknowledged as an effective defense strategy against adversarial
attacks in centralized training, we shed light on the adverse effects of
directly applying AT in FL that can severely compromise accuracy, especially in
non-IID challenges. Given this limitation, this paper proposes FatCC, which
incorporates local logit \underline{C}alibration and global feature
\underline{C}ontrast into the vanilla federated adversarial training
(\underline{FAT}) process from both logit and feature perspectives. This
approach can effectively enhance the federated system's robust accuracy (RA)
and clean accuracy (CA). First, we propose logit calibration, where the logits
are calibrated during local adversarial updates, thereby improving adversarial
robustness. Second, FatCC introduces feature contrast, which involves a global
alignment term that aligns each local representation with unbiased global
features, thus further enhancing robustness and accuracy in federated
adversarial environments. Extensive experiments across multiple datasets
demonstrate that FatCC achieves comparable or superior performance gains in
both CA and RA compared to other baselines.

本文介绍了 LHD 的一个解决方案，名为 FatCC，通过在 local adversarial updates 过程中对 logit 进行校准，以及引入 feature contrast 的全球对齐术语，从 logit 和 feature 两个角度进一步改善联合对抗训练的稳健性和准确性。实验结果表明，与其他基线相比，FatCC 在 clean accuracy 和 robust accuracy 方面取得了可比或更高的性能提升。