通过激活熵检测对抗样本，无需修改模型即可实时识别
Entropy-Based Non-Invasive Reliability Monitoring of Convolutional Neural Networks
- 利用卷积层激活熵的异常变化检测对抗样本
- 在VGG-16上实现90%检测率，误报与漏报均低于20%
- 适合部署于对安全性要求高的视觉系统
卷积神经网络（CNN）已成为现代计算机视觉的基础，在多种图像识别任务中达到前所未有的准确率。尽管其在分布内数据上表现优异，却对难以察觉的对抗扰动极为敏感，此类扰动可导致高置信度误分类。现有检测方法或需昂贵重训练、修改网络结构，或损害干净输入性能。本文表明，对抗扰动会在CNN激活中产生即时可检测的熵特征，无需任何模型修改即可监测。在VGG-16上并行监控熵值发现，对抗输入使早期卷积层激活熵平均提升7%，实现90%检测准确率，且误报率与漏报率均低于20%。清洁与对抗样本的熵分布完全分离，揭示了CNN天然将分布偏移编码于激活模式之中。本研究证明仅通过激活熵即可评估CNN可靠性，支持无需牺牲原模型性能的实时自诊断视觉系统部署。
原文摘要 · Abstract (English)
Convolutional Neural Networks (CNNs) have become the foundation of modern computer vision, achieving unprecedented accuracy across diverse image recognition tasks. While these networks excel on in-distribution data, they remain vulnerable to adversarial perturbations imperceptible input modifications that cause misclassification with high confidence. However, existing detection methods either require expensive retraining, modify network architecture, or degrade performance on clean inputs. Here we show that adversarial perturbations create immediate, detectable entropy signatures in CNN activations that can be monitored without any model modification. Using parallel entropy monitoring on VGG-16, we demonstrate that adversarial inputs consistently shift activation entropy by 7% in early convolutional layers, enabling 90% detection accuracy with false positives and false negative rates below 20%. The complete separation between clean and adversarial entropy distributions reveals that CNNs inherently encode distribution shifts in their activation patterns. This work establishes that CNN reliability can be assessed through activation entropy alone, enabling practical deployment of self-diagnostic vision systems that detect adversarial inputs in real-time without compromising original model performance.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。