提出HyCAS模型，同时提升模型的可证明鲁棒性和实际抗攻击能力。
Certified vs. Empirical Adversarial Robust-ness via Hybrid Convolutions with Attention Stochasticity
- 融合确定性与随机性设计，通过谱归一化卷积和随机注意力噪声实现防御
- 在NIH Chest X-ray上认证准确率提升7.3%，在HAM10000上实测鲁棒性提升3.1%
- 适合对安全性要求高的图像识别场景，如医疗影像分析
我们提出混合卷积与注意力随机性（HyCAS），一种可同时缩小L2可证明鲁棒性与强对抗攻击下经验鲁棒性之间差距的防御方法，且保持在多种图像基准上的强泛化能力。HyCAS通过将1-利普希茨、谱归一化卷积与两种随机组件——谱归一化随机投影滤波器和随机注意力噪声机制——结合，构建随机防御架构。在结构内注入平滑随机性，使整体网络满足≤2-利普希茨约束，并获得正式证书。在CIFAR-10/100、ImageNet-1k、NIH Chest X-ray、HAM10000等多样图像基准上的大量实验表明，HyCAS优于以往领先的可证明与经验防御方法，在NIH Chest X-ray上认证准确率最高提升7.3%，在HAM10000上经验鲁棒性最高提升3.1%，且不牺牲干净准确率。结果表明，随机利普希茨约束架构可同步提升可证明的L2鲁棒性与经验的L∞对抗鲁棒性，支持深度模型在高风险应用中的更安全部署。代码已开源。
原文摘要 · Abstract (English)
We introduce Hybrid Convolutions with Attention Stochasticity (HyCAS), an adversarial defense that narrows the long-standing gap between provable robustness under L2 certificates and empirical robustness against strong L attacks, while preserving strong generalization across diverse imaging benchmarks. HyCAS unifies deterministic and randomized principles by coupling 1-Lipschitz, spectrally normalized convolutions with two stochastic components, spectral normalized random, projection filters and a randomized attention-noise mechanism, to realize a randomized defense. Injecting smoothing randomness inside the architecture yields an overall <= 2-Lipschitz network with formal certificates. Exten-sive experiments on diverse imaging benchmarks, including CIFAR-10/100, ImageNet-1k, NIH Chest X-ray, HAM10000, show that HyCAS surpasses prior leading certified and empirical defenses, boosting certified accuracy by up to 7.3% (on NIH Chest X-ray) and empirical robustness by up to 3.1% (on HAM10000), without sacrificing clean accuracy. These results show that a randomized Lipschitz constrained architecture can simultaneously improve both certified L2 and empirical L adversarial robustness, thereby supporting safer deployment of deep models in high-stakes applications. Code: https://github.com/misti1203/HyCAS
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。