解决小模型对抗鲁棒性偏科问题,让所有类别均衡抗干扰。
Towards Class-wise Fair Adversarial Training via Anti-Bias Soft Label Distillation
- 通过动态调节教师软标签的平滑度,自适应缩小不同类别的错误风险差距。
- 在CIFAR-10/100上,对难分类样本的鲁棒性提升超15%,公平性显著改善。
- 方法通用性强,可与基于样本的对抗训练结合使用,适合模型部署场景。
对抗训练(AT)被广泛认为是提升深度神经网络对抗鲁棒性的有效方法。作为AT的一种变体,对抗鲁棒性蒸馏(ARD)在提升小型模型鲁棒性方面表现优异。然而,AT和ARD均存在鲁棒性公平性问题:模型对某些类别(易类)表现出强鲁棒性,而对另一些类别(难类)则较弱。本文通过实证观察与理论分析指出,不同类别的软标签平滑度差异是造成该问题的关键因素。基于此,本文提出在知识蒸馏框架下的无偏软标签蒸馏(ABSLD),通过为不同类别分配可变温度来动态调整教师模型软标签的类间平滑度,从而自适应减小学生模型在不同类别间的误差风险差距。此外,作为一种基于标签的方法,ABSLD具有高度可扩展性,可与基于样本的方法结合。大量实验表明,ABSLD在鲁棒性和公平性综合性能上优于现有最先进方法。
原文摘要 · Abstract (English)
Adversarial Training (AT) is widely recognized as an effective approach to enhance the adversarial robustness of Deep Neural Networks. As a variant of AT, Adversarial Robustness Distillation (ARD) has shown outstanding performance in enhancing the robustness of small models. However, both AT and ARD face robust fairness issue: these models tend to display strong adversarial robustness against some classes (easy classes) while demonstrating weak adversarial robustness against others (hard classes). This paper explores the underlying factors of this problem and points out the smoothness degree of soft labels for different classes significantly impacts the robust fairness from both empirical observation and theoretical analysis. Based on the above exploration, we propose Anti-Bias Soft Label Distillation (ABSLD) within the Knowledge Distillation framework to enhance the adversarial robust fairness. Specifically, ABSLD adaptively reduces the student's error risk gap between different classes, which is accomplished by adjusting the class-wise smoothness degree of teacher's soft labels during the training process, and the adjustment is managed by assigning varying temperatures to different classes. Additionally, as a label-based approach, ABSLD is highly adaptable and can be integrated with the sample-based methods. Extensive experiments demonstrate ABSLD outperforms state-of-the-art methods on the comprehensive performance of robustness and fairness.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。