简单方法比复杂方法更有效提升模型抗攻击能力。
Does simple trump complex? Comparing strategies for adversarial robustness in DNNs
- 通过调整损失函数直接扩大输入空间的决策边界距离。
- 在CIFAR-10上，简单方法在对抗攻击下表现优于复杂方法。
- 适合关注模型鲁棒性设计的研究者和工程师参考。
深度神经网络（DNN）在诸多应用中取得显著成功，但仍易受对抗攻击影响。本研究旨在识别并分离两种不同对抗训练技术中对提升对抗鲁棒性贡献最大的组件，特别从输入空间的边界间距（即数据点与决策边界的最小距离）角度进行分析。我们对比了两种最大化间距的方法：一种是通过修改损失函数来增大间距近似值的简单策略；另一种是基于此的更复杂的前沿方法（Dynamics-Aware Robust Training）。以VGG-16为基线模型，我们系统地隔离并评估这些方法中的各个组件对对抗鲁棒性的相对影响。在CIFAR-10数据集上，通过AutoAttack和Projected Gradient Descent（PGD）等攻击手段评估性能，结果揭示了最有效的增强机制，为设计更具鲁棒性的DNN提供了关键洞见。
原文摘要 · Abstract (English)
Deep Neural Networks (DNNs) have shown substantial success in various applications but remain vulnerable to adversarial attacks. This study aims to identify and isolate the components of two different adversarial training techniques that contribute most to increased adversarial robustness, particularly through the lens of margins in the input space -- the minimal distance between data points and decision boundaries. Specifically, we compare two methods that maximize margins: a simple approach which modifies the loss function to increase an approximation of the margin, and a more complex state-of-the-art method (Dynamics-Aware Robust Training) which builds upon this approach. Using a VGG-16 model as our base, we systematically isolate and evaluate individual components from these methods to determine their relative impact on adversarial robustness. We assess the effect of each component on the model's performance under various adversarial attacks, including AutoAttack and Projected Gradient Descent (PGD). Our analysis on the CIFAR-10 dataset reveals which elements most effectively enhance adversarial robustness, providing insights for designing more robust DNNs.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。