论文标题
基于KNN和KNN的模型上的最小符号对抗示例
Minimum-Norm Adversarial Examples on KNN and KNN-Based Models
论文作者
论文摘要
我们研究了将KNN与神经网络相结合的KNN分类器和分类器的对抗性例子的鲁棒性。主要的困难在于，在典型数据集中找到对KNN的最佳攻击是棘手的。在这项工作中，我们提出了对基于KNN和KNN的防御的基于梯度的攻击，灵感来自Sitawarin＆Wagner先前的工作[1]。我们证明，我们的攻击在我们测试的所有模型上都比计算时间最小增加的所有模型都表现优于他们的方法。当K> 1使用其运行时间的1％时，攻击还击败了KNN的最新攻击[2]。我们希望这种攻击可以用作评估KNN及其变体的鲁棒性的新基线。
We study the robustness against adversarial examples of kNN classifiers and classifiers that combine kNN with neural networks. The main difficulty lies in the fact that finding an optimal attack on kNN is intractable for typical datasets. In this work, we propose a gradient-based attack on kNN and kNN-based defenses, inspired by the previous work by Sitawarin & Wagner [1]. We demonstrate that our attack outperforms their method on all of the models we tested with only a minimal increase in the computation time. The attack also beats the state-of-the-art attack [2] on kNN when k > 1 using less than 1% of its running time. We hope that this attack can be used as a new baseline for evaluating the robustness of kNN and its variants.
