Latent Danger Zone: Distilling Unified Attention for Cross-Architecture Black-box Attacks
This addresses the challenge of limited access to model internals in black-box attacks, offering a more efficient and generalizable approach for adversarial machine learning.
The paper tackled the problem of black-box adversarial attacks by proposing JAD, a latent diffusion model framework that uses attention maps from CNN and ViT models to generate adversarial examples, achieving improved cross-architecture transferability and reduced query costs compared to existing methods.
Black-box adversarial attacks remain challenging due to limited access to model internals. Existing methods often depend on specific network architectures or require numerous queries, resulting in limited cross-architecture transferability and high query costs. To address these limitations, we propose JAD, a latent diffusion model framework for black-box adversarial attacks. JAD generates adversarial examples by leveraging a latent diffusion model guided by attention maps distilled from both a convolutional neural network (CNN) and a Vision Transformer (ViT) models. By focusing on image regions that are commonly sensitive across architectures, this approach crafts adversarial perturbations that transfer effectively between different model types. This joint attention distillation strategy enables JAD to be architecture-agnostic, achieving superior attack generalization across diverse models. Moreover, the generative nature of the diffusion framework yields high adversarial sample generation efficiency by reducing reliance on iterative queries. Experiments demonstrate that JAD offers improved attack generalization, generation efficiency, and cross-architecture transferability compared to existing methods, providing a promising and effective paradigm for black-box adversarial attacks.