arXiv:2512.12997cs.CVcs.AI2025-12

提升CLIP在对抗攻击下的不确定性校准能力,避免过自信错误。

Calibrating Uncertainty for Zero-Shot Adversarial CLIP

  • 用狄利克雷分布重参数化输出,统一建模语义结构与置信度。
  • 对抗扰动下不确定性反而下降的问题得到缓解,校准效果显著提升。
  • 适合关注模型可靠性与零样本鲁棒性的研究者使用。

CLIP具备强大的零样本分类能力,但对对抗攻击仍高度敏感。以往的对抗微调方法主要追求干净样本与对抗样本间预测逻辑的一致性,忽略了不确定性校准,可能损害零样本泛化性能。可靠不确定性估计的一个基本要求是:输入越难或偏离训练分布时,预测不确定性应越高。然而在对抗场景中,我们常观察到相反现象:扰动不仅降低准确率,还压制了不确定性,导致严重校准偏差和过度自信。这揭示了超越鲁棒性的关键可靠性缺口。为此,我们提出一种考虑准确率与不确定性的对抗微调目标。通过将CLIP输出重参数化为狄利克雷分布的集中参数,构建统一表征,同时捕捉相对语义结构与置信度大小。该方法实现扰动下的整体分布对齐,突破单个逻辑值锚定的局限,恢复校准的不确定性。在多个零样本基准测试中,我们的方法显著改善了不确定性校准,实现了具有竞争力的对抗鲁棒性,同时保持了干净样本的准确率。

原文摘要 · Abstract (English)

CLIP delivers strong zero-shot classification but remains highly vulnerable to adversarial attacks. Prior adversarial fine-tuning work primarily matches predicted logits between clean and adversarial examples, which overlooks uncertainty calibration and may degrade the zero-shot generalization. A common expectation in reliable uncertainty estimation is that predictive uncertainty should increase as inputs become more difficult or shift away from the training distribution. However, we frequently observe the opposite in the adversarial setting: perturbations not only degrade accuracy but also suppress uncertainty, leading to severe miscalibration and over-confidence. This reveals a critical reliability gap beyond robustness. To bridge this gap, we propose an adversarial fine-tuning objective for CLIP considering both accuracy and uncertainty. By reparameterizing CLIP outputs as the concentration parameters of a Dirichlet distribution, we propose a unified representation that captures relative semantic structure and confidence magnitude. This enables holistic distribution alignment under perturbations, moving beyond single-logit anchoring and restoring calibrated uncertainty. Experiments across multiple zero-shot benchmarks demonstrate that our method significantly improves uncertainty calibration and achieves competitive adversarial robustness while preserving clean accuracy.

CLIP对抗鲁棒性不确定性校准零样本

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。