DASH：一种合成有效且隐蔽对抗样本的元攻击框架
DASH: A Meta-Attack Framework for Synthesizing Effective and Stealthy Adversarial Examples
DASH 提供了一种可微元攻击框架，通过可学习权重组合多个 Lp 攻击来生成感知对齐的对抗样本，可直接用于评估视觉模型在感知度量约束下的鲁棒性，并为对抗训练提供更贴近人类感知的扰动样本。
原文依据 DASH, a differentiable meta-attack framework that generates effective and perceptually aligned adversarial examples by strategically composing existing Lp-based attack methods.
摘要译文
由模型翻译 · 术语统一 · 请对照原文核对关键结论在严格的 Lp 范数约束下生成对抗样本的技术已被大量提出。然而，此类范数有界样本往往难以与人类感知良好对齐，且仅有少数方法专门探索感知对齐的对抗样本。此外，Lp 约束攻击中的洞见能否有效用于提升感知效能仍不明确。本文提出 DASH，一种可微元攻击框架，通过策略性地组合现有基于 Lp 的攻击方法来生成有效且感知对齐的对抗样本。DASH 以多阶段方式运行：每个阶段使用学习到的自适应权重聚合来自多个基础攻击的候选对抗样本，并将结果传播至下一阶段。元损失函数通过联合最小化误分类损失和感知失真来引导该过程，使框架能够在各阶段动态调节每个基础攻击的贡献。我们在 CIFAR-10、CIFAR-100 和 ImageNet 上对对抗训练鲁棒模型评估 DASH，并在扰动预算中考虑视觉感知指标（如 SSIM、FID、LPIPS）而非 Lp 范数。尽管仅依赖基于 Lp 约束的方法，DASH 显著优于 AdvAD 等最优感知攻击，实现了更高的攻击成功率（例如提升 20.63%）和更优的视觉质量，以 SSIM、LPIPS 和 FID 衡量分别提升 11、0.015 和 5.7。DASH 能很好地泛化到未见防御以及不同的白盒/黑盒场景，使其成为评估鲁棒性的实用且强力的基线。
英文原文摘要 1732 字符
Numerous techniques have been proposed for generating adversarial examples under strict Lp-norm constraints. However, such norm-bounded examples often fail to align well with human perception, and only a few methods specifically explore perceptually aligned adversarial examples. Moreover, it remains unclear whether insights from Lp-constrained attacks can be effectively leveraged to improve perceptual efficacy. In this paper, we introduce DASH, a differentiable meta-attack framework that generates effective and perceptually aligned adversarial examples by strategically composing existing Lp-based attack methods. DASH operates in a multi-stage fashion: at each stage, it aggregates candidate adversarial examples from multiple base attacks using learned, adaptive weights and propagates the result to the next stage. A meta-loss function guides this process by jointly minimizing misclassification loss and perceptual distortion, enabling the framework to dynamically modulate the contribution of each base attack throughout the stages. We evaluate DASH on adversarially trained robust models across CIFAR-10, CIFAR-100, and ImageNet while considering visual perception metrics (e.g. SSIM, FID, LPIPS) in the perturbation budget (instead of Lp-norm). Despite relying solely on Lp-constrained based methods, DASH significantly outperforms state-of-the-art perceptual attacks such as AdvAD, achieving higher attack success rates (e.g., 20.63% improvement) and superior visual quality, as measured by SSIM, LPIPS, and FID (improvements of 11, 0.015, and 5.7, respectively). DASH generalizes well to unseen defenses and different white-box/black-box scenarios, making it a practical and strong baseline for evaluating robustness.