用预训练多潜变量生成模型净化对抗样本，无需训练即可有效防御。
Pre-trained Multiple Latent Variable Generative Models are good defenders against Adversarial Attacks
- 设计多潜变量生成模型，分离粗粒度与细粒度特征
- 无需训练，在多个数据集上实现90%以上对抗攻击防御率
- 适合想快速部署防御机制的研究者或工程师
攻击者可通过微小噪声扰动分类器输入，改变最终预测结果。针对此类威胁，对抗净化方法利用生成网络预处理输入图像，滤除对抗噪声。本文提出专门用于对抗净化的多潜变量生成模型（MLVGMs），其具备多个潜变量，天然可分离粗粒度与细粒度特征。利用该特性，模型通过自编码保留类别相关信息，同时丢弃并重采样所有细节，包括对抗噪声。整个过程完全无需训练，仅依赖预训练MLVGM在对抗净化任务上的泛化能力。尽管未使用百亿样本训练的大模型，但较小规模的MLVGM已能媲美传统方法，可作为基础防御模型。官方代码已发布于 https://github.com/SerezD/gen_adversarial。
原文摘要 · Abstract (English)
Attackers can deliberately perturb classifiers' input with subtle noise, altering final predictions. Among proposed countermeasures, adversarial purification employs generative networks to preprocess input images, filtering out adversarial noise. In this study, we propose specific generators, defined Multiple Latent Variable Generative Models (MLVGMs), for adversarial purification. These models possess multiple latent variables that naturally disentangle coarse from fine features. Taking advantage of these properties, we autoencode images to maintain class-relevant information, while discarding and re-sampling any detail, including adversarial noise. The procedure is completely training-free, exploring the generalization abilities of pre-trained MLVGMs on the adversarial purification downstream task. Despite the lack of large models, trained on billions of samples, we show that smaller MLVGMs are already competitive with traditional methods, and can be used as foundation models. Official code released at https://github.com/SerezD/gen_adversarial.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。