用轻量级补丁动态加固大视觉模型，对抗攻击下准确率提升超24%
Elytra: A Flexible Framework for Securing Large Vision Systems
- 用低秩适配技术训练可动态更新的安全补丁
- 在对抗样本下使分类准确率最高提升24.09%
- 无需重新训练主模型，适合已部署系统快速响应新漏洞
对抗攻击已成为自动驾驶系统的关键威胁。这类攻击利用神经网络的内在脆弱性，通过几乎不可见的小扰动，导致系统行为被恶意改变，例如使交通标志分类模型将停车标志误判为限速标志。以往的防御方法要么泛化能力差，要么需在训练中知晓攻击方式，或计算开销过大。本文提出 ELYTRA 框架，借鉴参数高效微调思想，采用低秩适配（LoRA）训练轻量级安全补丁，可在不重训主模型的前提下，动态修复已部署的大规模视觉系统。实验表明，该框架可使预训练大视觉模型在对抗样本下分类准确率最高提升24.09%。
原文摘要 · Abstract (English)
Adversarial attacks have emerged as a critical threat to autonomous driving systems. These attacks exploit the underlying neural network, allowing small, almost invisible, perturbations to alter the behavior of such systems in potentially malicious ways, e.g., causing a traffic sign classification network to misclassify a stop sign as a speed limit sign. Prior work in hardening such systems against adversarial attacks has looked at fine-tuning of the system or adding additional pre-processing steps to the input pipeline. Such solutions either have a hard time generalizing, require knowledge of adversarial attacks during training, or are computationally undesirable. Instead, we propose a framework called ELYTRA to take insights for parameter-efficient fine-tuning and use low-rank adaptation (LoRA) to train a lightweight security patch (or patches), enabling us to dynamically patch large pre-existing vision systems as new vulnerabilities are discovered. We demonstrate that the ELYTRA framework can patch pre-trained large vision models to improve classification accuracy by up to 24.09% in the presence of adversarial examples.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。