【摘要】 针对DiffAttack在语义引导、显著性区域及图像自然性等方面存在的问题,提出语义引导局部扰动的扩散模型对抗样本生成方法.首先,设计文本嵌入模块,在扩散模型去噪过程开始前对文本嵌入进行迭代优化,生成用于引导语义偏移的对抗性文本嵌入,作为引导去噪的条件.然后,在去噪过程中,加入局部掩码融合模块,在潜空间中对显著区域注入局部扰动,提升对抗样本的攻击性.最后,采用多层次联合感知损失函数,在图像与潜在空间层面联合约束感知差异,保持对抗样本攻击性的同时增强图像的自然性.在ImageNet-Compatible子集上以Inception作为代理模型生成对抗样本,并迁移至3种不同的模型架构中进行评估.结果显示,相比DiffAttack,文中方法的平均Top-1准确率降低2.8%,FID(Fréchet Inception Distance)指标提升0.4,说明文中方法生成的对抗样本在保持图像自然性的同时具有更强的攻击性,能更好地检测模型在安全性和鲁棒性方面存在的问题,具有更强的实用价值.更多还原

【Abstract】 To address the issues of diffusion-based adversarial example generation methods(DiffAttack) in semantic guidance, salient regions, and image naturalness, an adversarial example generation method based on semantic-guided local perturbation diffusion model is proposed in this paper. First, a text embedding module is designed to iteratively optimize the text embedding before the denoising process of the diffusion model. The adversarial text embeddings used to guide semantic shifts are generated and adopted as the conditions for denoising. Second, a local mask fusion module is incorporated into the denoising process. The local perturbations are injected into salient regions in the latent space to enhance the attack effectiveness of the adversarial examples. Finally, a multi-level joint perceptual loss function is employed to jointly constrain perceptual differences at both the image and latent space levels. The image naturalness is enhanced while the attack effectiveness of the adversarial examples is maintained. Adversarial examples are generated on the ImageNet-Compatible subset using Inception as a proxy model, and are evaluated across three different model architectures. The results show that, compared with DiffAttack, the proposed method reduces the average Top-1 accuracy by 2.8% while improving the FID(Fréchet Inception Distance) score by 0.4. These results demonstrate that the proposed method generates adversarial examples with both stronger attack effectiveness and enhanced image naturalness. The proposed method can better detect the issues in security and robustness of the model, exhibiting strong practical value.更多还原