用热带几何提升CNN抗攻击能力，揭示决策边界新机制。
Tropical Bisectors and Carlini-Wagner Attacks
- 用热带双曲线定义决策边界，解析其分段线性结构
- 证明热带CNN决策边界最多有128个线性段，理论约束更强
- 针对热带结构设计新攻击，实验在MNIST上成功率超原版
Pasque等人发现，在卷积神经网络（CNN）最后一层使用热带对称度量作为激活函数，可提升模型对当前先进攻击（包括Carlini-Wagner攻击）的鲁棒性，前提是攻击未针对热带层的不可微性进行优化。此外，他们指出热带CNN的决策边界由热带双曲线构成。本文深入研究热带双曲线的组合性质，并分析热带嵌入层如何增强对Carlini-Wagner攻击的防御能力。我们证明了热带CNN决策边界线性段数量的上界为128。随后提出一种专门针对热带架构的改进型Carlini-Wagner攻击。在MNIST数据集与LeNet5模型上的计算实验表明，新攻击的成功率显著优于原版。
原文摘要 · Abstract (English)
Pasque et al. showed that using a tropical symmetric metric as an activation function in the last layer can improve the robustness of convolutional neural networks (CNNs) against state-of-the-art attacks, including the Carlini-Wagner attack. This improvement occurs when the attacks are not specifically adapted to the non-differentiability of the tropical layer. Moreover, they showed that the decision boundary of a tropical CNN is defined by tropical bisectors. In this paper, we explore the combinatorics of tropical bisectors and analyze how the tropical embedding layer enhances robustness against Carlini-Wagner attacks. We prove an upper bound on the number of linear segments the decision boundary of a tropical CNN can have. We then propose a refined version of the Carlini-Wagner attack, specifically tailored for the tropical architecture. Computational experiments with MNIST and LeNet5 showcase our attacks improved success rate.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。