提出无需预设扰动分布的鲁棒性评估方法，更贴近真实场景。
Non-Parametric Probabilistic Robustness: A Conservative Risk Estimator under Unknown Perturbation Distributions
- 基于数据学习扰动分布，不依赖固定假设
- 在多个数据集上比现有方法给出更保守的鲁棒性估计
- 适合关注实际部署中模型安全性的研究者
深度学习模型虽表现优异，却易受微小输入扰动影响。为此，概率鲁棒性（PR）被提出作为对抗鲁棒性（AR）的补充。然而，现有PR方法假设扰动分布已知且固定，这在现实中难以满足。本文提出非参数概率鲁棒性（NPPR），一种不依赖预设扰动分布的更实用评估指标。NPPR采用非参数统计范式，直接从数据中学习最优扰动分布，可在分布不确定下实现保守评估。我们基于高斯混合模型（GMM）构建了NPPR估计器，覆盖输入相关与无关扰动场景。理论分析揭示了AR、PR与NPPR间的关联。在CIFAR-10、CIFAR-100和Tiny ImageNet上对ResNet18/50、WideResNet50和VGG16的实验表明，相较于现有方法常用扰动分布假设，NPPR给出更低（更保守）的鲁棒性估计，验证其更强实用性。
原文摘要 · Abstract (English)
Deep learning (DL) models, despite their remarkable success, remain vulnerable to small input perturbations that can cause erroneous outputs, motivating the recent proposal of probabilistic robustness (PR) as a complementary alternative to adversarial robustness (AR). However, existing PR formulations assume a fixed and known perturbation distribution, an unrealistic expectation in practice. To address this limitation, we propose non-parametric probabilistic robustness (NPPR), a more practical PR metric that does not rely on any predefined perturbation distribution. Following the non-parametric paradigm in statistical modeling, NPPR learns an optimized perturbation distribution directly from data, enabling conservative PR evaluation under distributional uncertainty. We further develop an NPPR estimator based on a Gaussian Mixture Model (GMM), covering various input-dependent and input-independent perturbation scenarios. Theoretical analyses establish the relationships among AR, PR, and NPPR. Extensive experiments on CIFAR-10, CIFAR-100, and Tiny ImageNet across ResNet18/50, WideResNet50 and VGG16 validate NPPR as a more practical robustness metric, showing conservative (lower) PR estimates compared to assuming those common perturbation distributions used in state-of-the-arts.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。