通过参数插值稳定训练，提升模型抗对抗样本能力
Parameter Interpolation Adversarial Training for Robust Image Classification
- 用前后周期参数插值平滑决策边界变化
- 在多个数据集上显著提升CNN与ViT的鲁棒性
- 结合归一化均方误差优化逻辑值对齐，适合安全敏感场景
尽管深度神经网络在各类任务中表现优异，仍易受对抗样本影响。对抗训练被证明是最有效的防御方法，但现有方法存在训练过程中鲁棒性波动和过拟合问题，降低防御效果。为此，我们提出一种新框架——参数插值对抗训练（PIAT）。PIAT通过在每轮训练间对前一轮与当前轮参数进行插值，使模型决策边界变化更平缓，缓解过拟合，促进更好收敛并提升鲁棒性。此外，我们建议使用归一化均方误差（NMSE）进一步增强鲁棒性，通过对齐干净样本与对抗样本的逻辑值相对幅度而非绝对幅度。在多个基准数据集上的大量实验表明，该框架能显著提升卷积神经网络（CNNs）和视觉变换器（ViTs）的鲁棒性。
原文摘要 · Abstract (English)
Though deep neural networks exhibit superior performance on various tasks, they are still plagued by adversarial examples. Adversarial training has been demonstrated to be the most effective method to defend against adversarial attacks. However, existing adversarial training methods show that the model robustness has apparent oscillations and overfitting issues in the training process, degrading the defense efficacy. To address these issues, we propose a novel framework called Parameter Interpolation Adversarial Training (PIAT). PIAT tunes the model parameters between each epoch by interpolating the parameters of the previous and current epochs. It makes the decision boundary of model change more moderate and alleviates the overfitting issue, helping the model converge better and achieving higher model robustness. In addition, we suggest using the Normalized Mean Square Error (NMSE) to further improve the robustness by aligning the relative magnitude of logits between clean and adversarial examples rather than the absolute magnitude. Extensive experiments conducted on several benchmark datasets demonstrate that our framework could prominently improve the robustness of both Convolutional Neural Networks (CNNs) and Vision Transformers (ViTs).
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。