发现对抗样本比正常样本更易受遮挡影响，提出新检测方法提升模型鲁棒性。
Deep learning models are vulnerable, but adversarial examples are even more vulnerable
- 通过遮挡实验发现对抗样本信心波动更大
- 新方法在CIFAR-10上检测准确率超62%，最高达96.5%
- 适合需要高可靠性的安全场景使用
理解对抗样本与正常样本的本质差异是提升深度神经网络鲁棒性及检测对抗攻击的关键。本研究首次通过实证发现，基于图像的对抗样本对遮挡异常敏感。在CIFAR-10上，使用九种经典攻击（如FGSM、PGD）生成对抗样本，并与原始样本进行对比评估。提出滑动掩码置信度熵（SMCE）来量化模型在遮挡下的置信度波动。基于1800多张测试图像，结合掩码熵场图与统计分布分析，结果显示对抗样本在遮挡下的置信度波动显著高于原始样本。基于此，提出基于滑动窗口掩码的对抗样本检测方法（SWM-AED），避免传统对抗训练中的灾难性过拟合问题。在多个分类器和攻击类型下对CIFAR-10的评估表明，该方法表现稳健，多数情况下准确率超过62%，最高达96.5%。
原文摘要 · Abstract (English)
Understanding intrinsic differences between adversarial examples and clean samples is key to enhancing DNN robustness and detection against adversarial attacks. This study first empirically finds that image-based adversarial examples are notably sensitive to occlusion. Controlled experiments on CIFAR-10 used nine canonical attacks (e.g., FGSM, PGD) to generate adversarial examples, paired with original samples for evaluation. We introduce Sliding Mask Confidence Entropy (SMCE) to quantify model confidence fluctuation under occlusion. Using 1800+ test images, SMCE calculations supported by Mask Entropy Field Maps and statistical distributions show adversarial examples have significantly higher confidence volatility under occlusion than originals. Based on this, we propose Sliding Window Mask-based Adversarial Example Detection (SWM-AED), which avoids catastrophic overfitting of conventional adversarial training. Evaluations across classifiers and attacks on CIFAR-10 demonstrate robust performance, with accuracy over 62% in most cases and up to 96.5%.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。