Deep neural networks have proven to be vulnerable to adversarial attacks in
the form of adding specific perturbations on images to make wrong outputs.
Designing stronger adversarial attack methods can help more reliably evaluate
the robustness of DNN models. To release the harbor burden and improve the
attack performance, auto machine learning (AutoML) has recently emerged as one
successful technique to help automatically find the near-optimal adversarial
attack strategy. However, existing works about AutoML for adversarial attacks
only focus on $L_{\infty}$-norm-based perturbations. In fact, semantic
perturbations attract increasing attention due to their naturalnesses and
physical realizability. To bridge the gap between AutoML and semantic
adversarial attacks, we propose a novel method called multi-objective
evolutionary search of variable-length composite semantic perturbations
(MES-VCSP). Specifically, we construct the mathematical model of
variable-length composite semantic perturbations, which provides five
gradient-based semantic attack methods. The same type of perturbation in an
attack sequence is allowed to be performed multiple times. Besides, we
introduce the multi-objective evolutionary search consisting of NSGA-II and
neighborhood search to find near-optimal variable-length attack sequences.
Experimental results on CIFAR10 and ImageNet datasets show that compared with
existing methods, MES-VCSP can obtain adversarial examples with a higher attack
success rate, more naturalness, and less time cost.

为了构建更加强健的深度神经网络，本文提出了一种多目标进化搜索可变长度复合语义扰动的新方法，并在 CIFAR10 和 ImageNet 数据集上进行了实验，结果表明相较于传统方法，该方法可以以更短的时间成本获得更自然、攻击成功率更高的对抗样本。

可变复合语义扰动的多目标演化搜索

Multi-objective Evolutionary Search of Variable-length Composite  Semantic Perturbations

Despite transformers' impressive accuracy, their computational cost is often
prohibitive to use with limited computational resources. Most previous
approaches to improve inference efficiency require a separate model for each
possible computational budget. In this paper, we extend PoWER-BERT (Goyal et
al., 2020) and propose Length-Adaptive Transformer that can be used for various
inference scenarios after one-shot training. We train a transformer with
LengthDrop, a structural variant of dropout, which stochastically determines a
sequence length at each layer. We then conduct a multi-objective evolutionary
search to find a length configuration that maximizes the accuracy and minimizes
the efficiency metric under any given computational budget. Additionally, we
significantly extend the applicability of PoWER-BERT beyond sequence-level
classification into token-level classification with Drop-and-Restore process
that drops word-vectors temporarily in intermediate layers and restores at the
last layer if necessary. We empirically verify the utility of the proposed
approach by demonstrating the superior accuracy-efficiency trade-off under
various setups, including span-based question answering and text
classification. Code is available at
this https URL

本论文中提出了一种名为 Length-Adaptive Transformer 的方法，通过使用结构变体 dropout（LengthDrop）在一个转换器上一次训练即可在各种推理场景下使用，并使用多目标进化搜索查找在任何给定计算预算下最大化准确性和最小化效率度量的长度配置。此外，还通过 Drop-and-Restore 过程将 PoWER-BERT 的适用范围显着扩展到单词级分类中。该方法在各种设置下都展现了卓越的准确性和效率平衡性能。