Evasion Attacks (EA) are used to test the robustness of trained neural
networks by distorting input data to misguide the model into incorrect
classifications. Creating these attacks is a challenging task, especially with
the ever-increasing complexity of models and datasets. In this work, we
introduce a self-supervised, computationally economical method for generating
adversarial examples, designed for the unseen black-box setting. Adapting
techniques from representation learning, our method generates on-manifold EAs
that are encouraged to resemble the data distribution. These attacks are
comparable in effectiveness compared to the state-of-the-art when attacking the
model trained on, but are significantly more effective when attacking unseen
models, as the attacks are more related to the data rather than the model
itself. Our experiments consistently demonstrate the method is effective across
various models, unseen data categories, and even defended models, suggesting a
significant role for on-manifold EAs when targeting unseen models.

我们引入了一种自我监督、计算成本低的方法，用于在未知黑盒设置中生成对抗性样本，这些样本通过适应表示学习技术生成，并鼓励与数据分布相似，从而与受攻击的模型相关性更高，在攻击训练模型时与最先进方法相当有效，在攻击未知模型时则显著更有效，表明在针对未知模型时，基于流形的对抗性样本发挥了重要作用。