arXiv:2510.16171cs.LGcs.AI2025-10NeurIPS被引 12

通过引入旋转缩放对称性卷积,提升模型抗干扰能力。

Bridging Symmetry and Robustness: On the Role of Equivariance in Enhancing Adversarial Robustness

  • 在标准CNN中加入旋转缩放等变卷积层,利用输入对称性先验
  • 在CIFAR-10/100上实现比普通模型更高鲁棒性,且无需对抗训练
  • 理论证明可缩小假设空间、降低梯度复杂度,适合图像分类任务

对抗样本揭示了深度神经网络对微小输入扰动的高度敏感性。尽管对抗训练是主要防御手段,但通常计算成本高且可能损害干净数据准确率。本文通过在标准卷积神经网络中嵌入群等变卷积(特别是旋转和缩放等变层)来探索架构层面的鲁棒性增强方法。这些层编码了输入空间中的结构化变换先验,使模型行为与对称性一致,从而产生更平滑的决策边界并增强对对抗攻击的抵抗力。我们提出了两种对称感知架构:并行设计(独立处理标准与等变特征后融合)和级联设计(顺序应用等变操作)。理论上,此类模型可减少假设空间复杂度、正则化梯度,并在CLEVER框架下获得更紧的认证鲁棒性界。实验上,我们的模型在CIFAR-10、CIFAR-100和CIFAR-10C上均显著提升对抗鲁棒性和泛化性能,且无需对抗训练。结果表明,对称性强制架构是数据增强类防御的有效且原理清晰的替代方案。

原文摘要 · Abstract (English)

Adversarial examples reveal critical vulnerabilities in deep neural networks by exploiting their sensitivity to imperceptible input perturbations. While adversarial training remains the predominant defense strategy, it often incurs significant computational cost and may compromise clean-data accuracy. In this work, we investigate an architectural approach to adversarial robustness by embedding group-equivariant convolutions-specifically, rotation- and scale-equivariant layers-into standard convolutional neural networks (CNNs). These layers encode symmetry priors that align model behavior with structured transformations in the input space, promoting smoother decision boundaries and greater resilience to adversarial attacks. We propose and evaluate two symmetry-aware architectures: a parallel design that processes standard and equivariant features independently before fusion, and a cascaded design that applies equivariant operations sequentially. Theoretically, we demonstrate that such models reduce hypothesis space complexity, regularize gradients, and yield tighter certified robustness bounds under the CLEVER (Cross Lipschitz Extreme Value for nEtwork Robustness) framework. Empirically, our models consistently improve adversarial robustness and generalization across CIFAR-10, CIFAR-100, and CIFAR-10C under both FGSM and PGD attacks, without requiring adversarial training. These findings underscore the potential of symmetry-enforcing architectures as efficient and principled alternatives to data augmentation-based defenses.

对抗鲁棒性等变网络卷积神经网络

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。