用输出波动度检测模型推理时的对抗样本，无需标签即可预警
Volatility in Certainty (VC): A Metric for Detecting Adversarial Perturbations During Inference in Neural Network Classifiers
- 通过分析softmax输出的平滑性波动，定义无标签检测指标VC
- VC与分类准确率负相关（rho < -0.90），越不稳定越可能出错
- 适合实时系统中安全关键场景的异常早期预警
对抗鲁棒性是神经网络分类器部署中的关键挑战，尤其在推理时无真实标签的实时系统中。本文研究近期提出的无标签指标——确定性波动（Volatility in Certainty, VC），该指标通过测量排序后softmax输出的离散程度来量化模型置信度的不规则性。具体地，VC定义为相邻置信度值平方对数比的平均值，捕捉输出平滑性的局部波动。我们在基于MNIST训练的ANN和CNN，以及基于CIFAR-10训练的正则化VGG-like模型上进行实验，采用FGSM方法生成不同扰动强度的对抗样本，并逐步引入对抗样本构建混合测试集以评估VC在分布偏移下的敏感性。结果表明，分类准确率与log(VC)存在强负相关（多数情况下rho < -0.90），说明VC可有效反映性能下降而无需标签数据。这些发现使VC成为可扩展、与架构无关且适用于实时系统的性能监控指标，适合用于安全关键场景的早期预警。
原文摘要 · Abstract (English)
Adversarial robustness remains a critical challenge in deploying neural network classifiers, particularly in real-time systems where ground-truth labels are unavailable during inference. This paper investigates \textit{Volatility in Certainty} (VC), a recently proposed, label-free metric that quantifies irregularities in model confidence by measuring the dispersion of sorted softmax outputs. Specifically, VC is defined as the average squared log-ratio of adjacent certainty values, capturing local fluctuations in model output smoothness. We evaluate VC as a proxy for classification accuracy and as an indicator of adversarial drift. Experiments are conducted on artificial neural networks (ANNs) and convolutional neural networks (CNNs) trained on MNIST, as well as a regularized VGG-like model trained on CIFAR-10. Adversarial examples are generated using the Fast Gradient Sign Method (FGSM) across varying perturbation magnitudes. In addition, mixed test sets are created by gradually introducing adversarial contamination to assess VC's sensitivity under incremental distribution shifts. Our results reveal a strong negative correlation between classification accuracy and log(VC) (correlation rho < -0.90 in most cases), suggesting that VC effectively reflects performance degradation without requiring labeled data. These findings position VC as a scalable, architecture-agnostic, and real-time performance metric suitable for early-warning systems in safety-critical applications.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。