Adversarial attacks are an important security concern for computer vision (CV). As CV models are becoming increasingly valuable assets in applied practice, disrupting them is emerging as a form of economic sabotage. This paper opens up the exploration of damaging adversarial attacks (DAAs) that seek to damage target CV models. DAAs are formalized by defining the threat model, the cost function DAAs maximize, and setting three requirements for success: potency, stealth, and customizability. As a pioneer DAA, this paper proposes Trainwreck, a train-time attack that conflates the data of similar classes in the training data using stealthy ($\epsilon \leq 8/255$) class-pair universal perturbations obtained from a surrogate model. Trainwreck is a black-box, transferable attack: it requires no knowledge of the target architecture, and a single poisoned dataset degrades the performance of any model trained on it. The experimental evaluation on CIFAR-10 and CIFAR-100 and various model architectures (EfficientNetV2, ResNeXt-101, and a finetuned ViT-L-16) demonstrates Trainwreck's efficiency. Trainwreck achieves similar or better potency compared to the data poisoning state of the art and is fully customizable by the poison rate parameter. Finally, data redundancy with hashing is identified as a reliable defense against Trainwreck or similar DAAs. The code is available at https://github.com/JanZahalka/trainwreck.

翻译：对抗攻击是计算机视觉领域重要的安全问题。随着计算机视觉模型在应用实践中价值日益提升，干扰这些模型正成为一种经济破坏手段。本文开创性地探索了旨在破坏目标计算机视觉模型的破坏性对抗攻击。通过定义威胁模型、DAAs最大化的成本函数，并设定三个成功标准（有效性、隐蔽性和可定制性），本文形式化地提出了破坏性对抗攻击。作为开创性的破坏性对抗攻击方法，本文提出Trainwreck——一种训练时攻击，通过从代理模型获取隐蔽的（$\epsilon \leq 8/255$）类别对通用扰动，将训练数据中相似类别的数据混淆。Trainwreck是一种黑盒可迁移攻击：无需了解目标模型架构，单个被污染的数据集即可降低任何基于该数据集训练模型的性能。在CIFAR-10和CIFAR-100数据集及多种模型架构（EfficientNetV2、ResNeXt-101和微调后的ViT-L-16）上的实验评估证明了Trainwreck的有效性。相较于当前最先进的数据投毒方法，Trainwreck实现了相当或更优的破坏效果，并可通过投毒率参数完全定制。最后，研究发现基于哈希的数据冗余是防御Trainwreck或类似破坏性对抗攻击的可靠方法。代码发布于https://github.com/JanZahalka/trainwreck。