用因果启发的扩散模型分离关键因素，提升对抗防御能力。
CausalDiff: Causality-Inspired Disentanglement via Diffusion Model for Adversarial Defense
- 基于因果信息瓶颈设计扩散模型，分离标签相关与无关因素
- 在未见攻击下平均鲁棒性达86.39%（CIFAR-10），提升4.01%
- 适合关注对抗样本鲁棒性与可解释性的研究者
尽管持续努力防御神经分类器免受对抗攻击，其仍对未知攻击脆弱。相比之下，人类难以被细微扰动作弊，因我们仅基于本质因素判断。受此启发，我们尝试用本质标签因果因素建模标签生成，并引入非因果因素辅助数据生成。对于对抗样本，目标是将扰动识别为非因果因素，仅基于因果因素做出预测。具体地，提出因果扩散模型（CausalDiff），通过学习新颖的因果信息瓶颈目标，适配扩散模型实现条件数据生成并分离两类因果因素。实证表明，CausalDiff在多种未见攻击下显著优于现有最优防御方法：在CIFAR-10上平均鲁棒性达86.39%（+4.01%），CIFAR-100上为56.25%（+3.13%），GTSRB上为82.62%（+4.93%）。代码已开源。
原文摘要 · Abstract (English)
Despite ongoing efforts to defend neural classifiers from adversarial attacks, they remain vulnerable, especially to unseen attacks. In contrast, humans are difficult to be cheated by subtle manipulations, since we make judgments only based on essential factors. Inspired by this observation, we attempt to model label generation with essential label-causative factors and incorporate label-non-causative factors to assist data generation. For an adversarial example, we aim to discriminate the perturbations as non-causative factors and make predictions only based on the label-causative factors. Concretely, we propose a casual diffusion model (CausalDiff) that adapts diffusion models for conditional data generation and disentangles the two types of casual factors by learning towards a novel casual information bottleneck objective. Empirically, CausalDiff has significantly outperformed state-of-the-art defense methods on various unseen attacks, achieving an average robustness of 86.39% (+4.01%) on CIFAR-10, 56.25% (+3.13%) on CIFAR-100, and 82.62% (+4.93%) on GTSRB (German Traffic Sign Recognition Benchmark). The code is available at https://github.com/CAS-AISafetyBasicResearchGroup/CausalDiff.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。