通过多目标学习让模型更抗对抗攻击
Enhancing Adversarial Robustness through Multi-Objective Representation Learning
- 训练时用余弦相似度和多正样本对比损失对齐正常与对抗特征
- 在多种攻击下显著提升模型鲁棒性，白盒黑盒攻击均有效
- 无需修改架构或测试时净化数据，通用性强适合实际部署
深度神经网络对微小的对抗扰动敏感，这些看似无害的输入变化会导致模型输出剧烈偏差。许多防御方法需在推理阶段修改模型结构或进行测试时数据净化，不仅增加复杂性，还常依赖特定架构。本文表明，训练阶段进行鲁棒特征学习可显著提升DNN的抗干扰能力。提出MOREL方法，通过余弦相似度和多正样本对比损失，促使同类别输入在自然与对抗条件下产生相似特征表示。大量实验表明，MOREL在白盒与黑盒攻击下均显著增强模型鲁棒性。代码已开源：https://github.com/salomonhotegni/MOREL。
原文摘要 · Abstract (English)
Deep neural networks (DNNs) are vulnerable to small adversarial perturbations, which are tiny changes to the input data that appear insignificant but cause the model to produce drastically different outputs. Many defense methods require modifying model architectures during evaluation or performing test-time data purification. This not only introduces additional complexity but is often architecture-dependent. We show, however, that robust feature learning during training can significantly enhance DNN robustness. We propose MOREL, a multi-objective approach that aligns natural and adversarial features using cosine similarity and multi-positive contrastive losses to encourage similar features for same-class inputs. Extensive experiments demonstrate that MOREL significantly improves robustness against both white-box and black-box attacks. Our code is available at https://github.com/salomonhotegni/MOREL
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。