首次实现多范数联合鲁棒性训练，让模型同时抵抗多种攻击类型。
Towards Generalized Certified Robustness with Multi-Norm Training
- 提出多范数认证训练框架CURE，统一处理l∞、l2等不同扰动
- 在MNIST/CIFAR-10/TinyImageNet上联合鲁棒性分别提升32.0%/25.8%/10.6%
- 对未见的几何与补丁扰动也表现出更强泛化能力
现有认证训练方法仅能针对特定扰动类型（如l∞或l2）提供保障，但一个l∞认证鲁棒模型可能对l2扰动无保障（反之亦然），且对其他扰动（如几何变换、补丁扰动）鲁棒性较差。通过构建理论框架分析并缓解该权衡问题，本文提出首个多范数认证训练框架CURE，包含多个多范数认证训练方法，可从零开始训练或微调预训练认证模型，实现更好的联合鲁棒性。受理论发现启发，设计了边界对齐策略，并将自然训练与认证训练相连接以提升联合鲁棒性。相比最先进方法，CURE在MNIST上联合鲁棒性提升32.0%，CIFAR-10上提升25.8%，TinyImageNet上提升10.6%（跨不同ε值）。在多种挑战性的未见几何和补丁扰动下，性能分别提升6.8%和16.0%。整体贡献为实现广义认证鲁棒性开辟新路径。
原文摘要 · Abstract (English)
Existing certified training methods can only train models to be robust against a certain perturbation type (e.g. $l_\infty$ or $l_2$). However, an $l_\infty$ certifiably robust model may not be certifiably robust against $l_2$ perturbation (and vice versa) and also has low robustness against other perturbations (e.g. geometric and patch transformation). By constructing a theoretical framework to analyze and mitigate the tradeoff, we propose the first multi-norm certified training framework \textbf{CURE}, consisting of several multi-norm certified training methods, to attain better \emph{union robustness} when training from scratch or fine-tuning a pre-trained certified model. Inspired by our theoretical findings, we devise bound alignment and connect natural training with certified training for better union robustness. Compared with SOTA-certified training, \textbf{CURE} improves union robustness to $32.0\%$ on MNIST, $25.8\%$ on CIFAR-10, and $10.6\%$ on TinyImagenet across different epsilon values. It leads to better generalization on a diverse set of challenging unseen geometric and patch perturbations to $6.8\%$ and $16.0\%$ on CIFAR-10. Overall, our contributions pave a path towards \textit{generalized certified robustness}.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。