DASH: A Meta-Attack Framework for Synthesizing Effective and Stealthy Adversarial Examples
DASH:一种用于合成有效且隐蔽的对抗样本的元攻击框架
Abdullah Al Nomaan Nafi, Habibur Rahaman, Zafaryab Haider, Tanzim Mahfuz, Fnu Suya, Swarup Bhunia, Prabuddha Chakraborty
AI总结 提出DASH元攻击框架,通过多阶段自适应组合Lp约束攻击方法,生成有效且感知对齐的对抗样本,在多个数据集上优于现有方法。
Comments Accepted to CVPR 2026
详情
在白盒设置下,已有大量技术被提出用于在严格的Lp范数约束下生成对抗样本。然而,这类范数受限的样本往往与人类感知不一致,只有少数方法专门探索感知对齐的对抗样本。此外,尚不清楚能否有效利用Lp约束攻击的见解来提升感知效能。本文介绍DASH,一个完全可微的元攻击框架,通过策略性地组合现有基于Lp的攻击方法,生成有效且感知对齐的对抗样本。DASH以多阶段方式运行:在每个阶段,它使用学习到的自适应权重聚合来自多个基础攻击的候选对抗样本,并将结果传播到下一阶段。一种新颖的元损失函数通过联合最小化误分类损失和感知失真来指导这一过程,使框架能够动态调整每个基础攻击在各阶段的贡献。我们在CIFAR-10、CIFAR-100和ImageNet上对对抗训练模型评估DASH。尽管仅依赖基于Lp约束的方法,DASH显著优于最先进的感知攻击如AdvAD,实现了更高的攻击成功率(例如提升20.63%)和更优的视觉质量(以SSIM、LPIPS和FID衡量,分别提升约11、0.015和5.7)。此外,DASH对未见过的防御具有良好的泛化能力,使其成为评估鲁棒性的实用且强大的基线,无需为每种新防御手工设计自适应攻击。
Numerous techniques have been proposed for generating adversarial examples in white-box settings under strict Lp-norm constraints. However, such norm-bounded examples often fail to align well with human perception, and only a few methods specifically explore perceptually aligned adversarial examples. Moreover, it remains unclear whether insights from Lp-constrained attacks can be effectively leveraged to improve perceptual efficacy. In this paper, we introduce DASH, a fully differentiable meta-attack framework that generates effective and perceptually aligned adversarial examples by strategically composing existing Lp-based attack methods. DASH operates in a multi-stage fashion: at each stage, it aggregates candidate adversarial examples from multiple base attacks using learned, adaptive weights and propagates the result to the next stage. A novel meta-loss function guides this process by jointly minimizing misclassification loss and perceptual distortion, enabling the framework to dynamically modulate the contribution of each base attack throughout the stages. We evaluate DASH on adversarially trained models across CIFAR-10, CIFAR-100, and ImageNet. Despite relying solely on Lp-constrained based methods, DASH significantly outperforms state-of-the-art perceptual attacks such as AdvAD, achieving higher attack success rates (e.g., 20.63% improvement) and superior visual quality, as measured by SSIM, LPIPS, and FID (improvements $\approx$ of 11, 0.015, and 5.7, respectively). Furthermore, DASH generalizes well to unseen defenses, making it a practical and strong baseline for evaluating robustness without requiring handcrafted adaptive attacks for each new defense.