让模型持续抵御新旧攻击，通过优化逻辑空间距离提升鲁棒性。
Adapting to Evolving Adversaries with Regularized Continual Robust Training
- 在逻辑空间中正则化，防止微调时旧攻击鲁棒性下降。
- 在3个数据集上测试100+攻击组合，鲁棒准确率显著提升。
- 适合需要长期对抗新型攻击的部署场景，如安全防御系统。
鲁棒训练方法通常针对特定类型的攻击（如固定预算的Lp攻击），很少考虑防御者会随时间遭遇新攻击的情况。一种自然解决方案是通过微调使模型持续适应新攻击，我们称之为持续鲁棒训练（CRT）。然而，若直接实施，对新攻击的微调会导致对旧攻击的鲁棒性下降。本文提出理论分析表明，模型对不同攻击的鲁棒性差距受其在逻辑空间中样本扰动距离的限制，因此在该空间进行正则化有助于保持对旧攻击的鲁棒性。在CIFAR-10、CIFAR-100和ImageNette三个数据集上，超过100种攻击组合的实验验证了该方法在几乎不增加训练时间的情况下显著提升了鲁棒准确率。研究成果与开源代码为应对动态演变攻击的模型部署奠定了基础。
原文摘要 · Abstract (English)
Robust training methods typically defend against specific attack types, such as Lp attacks with fixed budgets, and rarely account for the fact that defenders may encounter new attacks over time. A natural solution is to adapt the defended model to new adversaries as they arise via fine-tuning, a method which we call continual robust training (CRT). However, when implemented naively, fine-tuning on new attacks degrades robustness on previous attacks. This raises the question: how can we improve the initial training and fine-tuning of the model to simultaneously achieve robustness against previous and new attacks? We present theoretical results which show that the gap in a model's robustness against different attacks is bounded by how far each attack perturbs a sample in the model's logit space, suggesting that regularizing with respect to this logit space distance can help maintain robustness against previous attacks. Extensive experiments on 3 datasets (CIFAR-10, CIFAR-100, and ImageNette) and over 100 attack combinations demonstrate that the proposed regularization improves robust accuracy with little overhead in training time. Our findings and open-source code lay the groundwork for the deployment of models robust to evolving attacks.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。