RaPA：通过随机参数剪枝增强可迁移目标攻击
RaPA: Enhancing Transferable Targeted Attacks via Random Parameter Pruning
提出参数级随机化（随机剪枝）作为提升对抗样本迁移性的手段，可复用于其他迁移攻击框架，尤其针对CNN到Transformer的跨架构攻击场景。
原文依据 RaPA randomly prunes model parameters to generate diverse yet semantically consistent surrogate variants.
摘要译文
由模型翻译 · 术语统一 · 请对照原文核对关键结论与无目标攻击相比，基于迁移的目标攻击成功率（ASR）仍然低得多，尽管已有多种方法（如输入多样化、梯度稳定化和替代模型重训练）取得了显著改进。本文发现，现有方法生成的对抗样本严重依赖替代模型的一小部分参数，这限制了它们对未见目标模型的迁移性。受此发现启发，我们提出了随机参数剪枝攻击（RaPA），在攻击过程中引入参数级随机化。在每次优化步骤中，RaPA随机剪枝模型参数，以生成多样但语义一致的替代模型变体。我们证明这种参数级随机化等价于添加一个重要性均衡正则化项，从而缓解过度依赖问题。在CNN和Transformer架构上的大量实验表明，RaPA显著提升了迁移性。在从CNN模型迁移到Transformer模型的挑战性场景中，RaPA的平均ASR比最优基线高出最多11.7%（达到33.3%的ASR），同时无需训练、跨架构高效且易于集成到现有攻击框架中。代码见 https://github.com/molarsu/RaPA。
英文原文摘要 1402 字符
Compared to untargeted attacks, targeted transfer-based attack still suffers from much lower Attack Success Rates (ASRs), although significant improvements have been achieved by kinds of methods, such as diversifying input, stabilizing the gradient, and re-training surrogate models. In this paper, we find that adversarial examples generated by existing methods rely heavily on a small subset of surrogate model parameters, which limits their transferability to unseen target models. Inspired by this finding, we propose Random Parameter Pruning Attack (RaPA), which introduces parameter-level randomization during the attack process. At each optimization step, RaPA randomly prunes model parameters to generate diverse yet semantically consistent surrogate variants. We show that this parameter-level randomization is equivalent to adding an importance-equalization regularizer, thereby alleviating the over-reliance issue. Extensive experiments across both CNN and Transformer architectures demonstrate that RaPA substantially enhances transferability. In the challenging case of transferring from CNN-based to Transformer-based models, RaPA achieves up to 11.7% higher average ASRs than state-of-the-art baselines (with 33.3% ASRs), while being training-free, cross-architecture efficient, and easily integrated into existing attack frameworks. Code is available on https://github.com/molarsu/RaPA.