通过空空间投影提升模型抗攻击能力，几乎不牺牲正常样本准确率。
NPAT Null-Space Projected Adversarial Training Towards Zero Deterioration
- 将输入扰动限制在决策边界的零空间内，抑制不可靠特征的干扰。
- 在CIFAR10和SVHN上实现与现有方法相当的鲁棒性，泛化性能接近高精度模型。
- 适合关注模型鲁棒性与泛化平衡的研究者和应用开发者。
为缓解神经网络对对抗攻击的脆弱性，对抗训练已成为主流且有效的防御策略。然而，该方法固有地存在权衡：以牺牲正常样本的准确性为代价提升鲁棒性。为调和这一矛盾，本文首次将零空间投影引入对抗训练，提出两种基于零空间投影的对抗训练算法（NPAT）——零空间投影数据增强（NPDA）与零空间投影梯度下降（NPGD），分别针对样本生成与梯度优化，旨在寻找全局最优解，实现鲁棒性提升而几乎无泛化性能损失。通过闭式零空间投影器，将对抗样本与扰动约束于决策边界的零空间内，有效削弱由不可靠特征引发的攻击威胁。我们在CIFAR10与SVHN数据集上进行实验，结果表明该方法可无缝集成至现有对抗训练框架，在保持接近高精度模型的泛化性能的同时，获得与当前方法相当的鲁棒性。
原文摘要 · Abstract (English)
To mitigate the susceptibility of neural networks to adversarial attacks, adversarial training has emerged as a prevalent and effective defense strategy. Intrinsically, this countermeasure incurs a trade-off, as it sacrifices the model's accuracy in processing normal samples. To reconcile the trade-off, we pioneer the incorporation of null-space projection into adversarial training and propose two innovative Null-space Projection based Adversarial Training(NPAT) algorithms tackling sample generation and gradient optimization, named Null-space Projected Data Augmentation (NPDA) and Null-space Projected Gradient Descent (NPGD), to search for an overarching optimal solutions, which enhance robustness with almost zero deterioration in generalization performance. Adversarial samples and perturbations are constrained within the null-space of the decision boundary utilizing a closed-form null-space projector, effectively mitigating threat of attack stemming from unreliable features. Subsequently, we conducted experiments on the CIFAR10 and SVHN datasets and reveal that our methodology can seamlessly combine with adversarial training methods and obtain comparable robustness while keeping generalization close to a high-accuracy model.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。