通过调整特征统计量不确定性,提升模型抗攻击能力。
Feature Statistics with Uncertainty Help Adversarial Robustness
- 利用高斯随机重采样通道均值与方差,动态校准被攻击扭曲的特征分布。
- 在标准数据集上对主流模型微调后,对抗攻击成功率降低17.13%~34.82%。
- 模块通用性强,训练、推理、微调均可使用,计算开销极低。
尽管深度神经网络(DNN)取得了显著成功,但对抗攻击对DNN的可靠性构成了严重威胁。本文从理论和实验两方面发现了一个此前被忽视的普遍现象:对抗攻击倾向于改变特征统计量的分布。受此启发,并结合不确定性感知随机方法在构建鲁棒模型中的优势,我们提出一种名为特征统计量不确定性(FSU)的增强模块。该模块对样本的通道级特征均值与标准差从多元高斯分布中随机重采样,帮助重建被扰动的样本并校准偏移的分布。校准过程恢复了数据的部分域特性,从而削弱扰动影响,降低攻击欺骗模型的能力。FSU模块在训练、攻击、预测和微调中均具通用性,在额外时间成本极低的情况下展现出显著的鲁棒性提升。例如,对成熟模型使用FSU微调后,在基准数据集上对强大AA和CW攻击的鲁棒性分别提升最高达17.13%和34.82%。
原文摘要 · Abstract (English)
Despite the remarkable success of deep neural networks (DNNs), the security threat of adversarial attacks poses a significant challenge to the reliability of DNNs. In this paper, both theoretically and empirically, we discover a universal phenomenon that has been neglected in previous works, i.e., adversarial attacks tend to shift the distributions of feature statistics. Motivated by this finding, and by leveraging the advantages of uncertainty-aware stochastic methods in building robust models efficiently, we propose an uncertainty-driven feature statistics adjustment module for robustness enhancement, named Feature Statistics with Uncertainty (FSU). It randomly resamples channel-wise feature means and standard deviations of examples from multivariate Gaussian distributions, which helps to reconstruct the perturbed examples and calibrate the shifted distributions. The calibration recovers some domain characteristics of the data for classification, thereby mitigating the influence of perturbations and weakening the ability of attacks to deceive models. The proposed FSU module has universal applicability in training, attacking, predicting, and fine-tuning, demonstrating impressive robustness enhancement ability at a trivial additional time cost. For example, by fine-tuning the well-established models with FSU, the state-of-the-art methods achieve up to 17.13% and 34.82% robustness improvement against powerful AA and CW attacks on benchmark datasets.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。