arXiv:2506.02016cs.CVcs.LG2025-06

通过分析网络层特征路径,实现无需训练的对抗样本检测。

Are classical deep neural networks weakly adversarially robust?

  • 利用层间特征路径与类别中心路径的相关性判断对抗样本
  • ResNet-20上达82.77%正常准确率、44.17%对抗准确率
  • 不依赖计算开销大的对抗训练,适合资源受限场景

对抗攻击受到广泛关注,普遍认为经典深度神经网络(DNN)对抗鲁棒性弱。主流防御方法对抗训练需生成对抗样本并重新训练模型,但计算开销大。本文受网络输出特征聚类特性及渐进前向坍缩(PFC)现象启发,提出一种基于层间特征路径与类别中心路径相关性的对抗样本检测与图像识别方法。实验表明,在带PFC的ResNet-20上,该方法实现82.77%的干净准确率和44.17%的对抗准确率;相比对抗训练(77.64%干净准确率,52.94%对抗准确率),虽有性能折衷但无需昂贵防御策略。在标准ResNet-18上,分别保持80.01%和46.1%的性能。结果揭示了DNN中存在固有对抗鲁棒性,挑战了传统认知。

原文摘要 · Abstract (English)

Adversarial attacks have received increasing attention and it has been widely recognized that classical DNNs have weak adversarial robustness. The most commonly used adversarial defense method, adversarial training, improves the adversarial accuracy of DNNs by generating adversarial examples and retraining the model. However, adversarial training requires a significant computational overhead. In this paper, inspired by existing studies focusing on the clustering properties of DNN output features at each layer and the Progressive Feedforward Collapse phenomenon, we propose a method for adversarial example detection and image recognition that uses layer-wise features to construct feature paths and computes the correlation between the examples feature paths and the class-centered feature paths. Experimental results show that the recognition method achieves 82.77% clean accuracy and 44.17% adversarial accuracy on the ResNet-20 with PFC. Compared to the adversarial training method with 77.64% clean accuracy and 52.94% adversarial accuracy, our method exhibits a trade-off without relying on computationally expensive defense strategies. Furthermore, on the standard ResNet-18, our method maintains this advantage with respective metrics of 80.01% and 46.1%. This result reveals inherent adversarial robustness in DNNs, challenging the conventional understanding of the weak adversarial robustness in DNNs.

对抗鲁棒性特征路径无训练防御

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。