adversarial pretraining让Transformer具备通用鲁棒性，仅靠上下文学习即可应对新任务攻击
Adversarially Pretrained Transformers May Be Universally Robust In-Context Learners
- 用对抗训练预训练单层线性Transformer，使其能通过上下文学习适应新任务
- 在未见过的分类任务上，模型仅用干净样本演示即实现鲁棒泛化，无需额外对抗训练
- 适合关注模型安全、希望低成本提升鲁棒性的研究者和工程师
对抗训练是防御对抗攻击最有效的方法之一，但计算成本高昂。本研究首次从理论上分析表明，经过对抗训练的Transformer可作为通用鲁棒基础模型——仅需轻量级调优即可在多样下游任务中稳健适应。具体而言，我们证明了在多种分类任务上经过对抗训练的单层线性Transformer，可通过仅使用干净示例的上下文学习，泛化到未见分类任务并保持鲁棒性。这种通用鲁棒性源于模型在给定任务中自适应聚焦于鲁棒特征的能力。我们还识别出实现鲁棒性的两个开放挑战：准确率-鲁棒性权衡及样本饥饿型训练。本研究开启了对通用鲁棒基础模型实用价值的讨论。尽管训练成本高，但一旦完成，下游任务可免费获得对抗鲁棒性。代码已开源：https://github.com/s-kumano/universally-robust-in-context-learner。
原文摘要 · Abstract (English)
Adversarial training is one of the most effective defenses against adversarial attacks, but it incurs a high computational cost. In this study, we present the first theoretical analysis suggesting that adversarially pretrained transformers can serve as universally robust foundation models -- models that can adapt robustly to diverse downstream tasks with only lightweight tuning. Specifically, we demonstrate that single-layer linear transformers, after adversarial pretraining across a variety of classification tasks, can generalize robustly to unseen classification tasks through in-context learning from clean demonstrations (i.e., without requiring additional adversarial training or examples). This universal robustness stems from the model's ability to adaptively focus on robust features within given tasks. We also identify two open challenges for attaining robustness: the accuracy-robustness trade-off and sample-hungry training. This study initiates the discussion on the utility of universally robust foundation models. While their training is expensive, the investment would prove worthwhile as downstream tasks can obtain adversarial robustness for free. The code is available at https://github.com/s-kumano/universally-robust-in-context-learner.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。