用生成模型提升分类器抗攻击能力，同时让决策过程更可解释。
Causal Interpretability for Adversarial Robustness: A Hybrid Generative Classification Approach
- 结合判别与生成模型，从数据分布建模增强鲁棒性。
- 在CIFAR-10/100上对白盒攻击实现更高防御性能。
- 揭示可解释性与抗攻击能力之间的内在关联，适合安全敏感场景。
基于深度学习的判别式分类器虽表现优异，但仍易受对抗样本干扰。尽管对抗训练能提升鲁棒性，却无法解决黑箱模型固有的脆弱性。本文提出一种深度集成模型，融合判别特征提取与生成分类网络，兼顾高准确率与抗攻击能力。底层采用预训练判别网络提取特征，顶层通过深度隐变量模型建模对抗输入分布，利用变分贝叶斯方法实现无需对抗训练的强鲁棒性。在CIFAR-10和CIFAR-100上的实验表明该模型显著优于现有方法。通过反事实指标与特征交互度量评估，建立了模型可解释性与对抗鲁棒性间的相关性。初步在Tiny-ImageNet上的结果验证了方法在更复杂数据集上的可扩展性，为构建鲁棒图像分类模型提供了实用方案。
原文摘要 · Abstract (English)
Deep learning-based discriminative classifiers, despite their remarkable success, remain vulnerable to adversarial examples that can mislead model predictions. While adversarial training can enhance robustness, it fails to address the intrinsic vulnerability stemming from the opaque nature of these black-box models. We present a deep ensemble model that combines discriminative features with generative models to achieve both high accuracy and adversarial robustness. Our approach integrates a bottom-level pre-trained discriminative network for feature extraction with a top-level generative classification network that models adversarial input distributions through a deep latent variable model. Using variational Bayes, our model achieves superior robustness against white-box adversarial attacks without adversarial training. Extensive experiments on CIFAR-10 and CIFAR-100 demonstrate our model's superior adversarial robustness. Through evaluations using counterfactual metrics and feature interaction-based metrics, we establish correlations between model interpretability and adversarial robustness. Additionally, preliminary results on Tiny-ImageNet validate our approach's scalability to more complex datasets, offering a practical solution for developing robust image classification models.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。