通过平滑检测分数提升模型对对抗攻击的鲁棒性，有效区分分布内与分布外样本。
A Robust Out-of-Distribution Detection Framework via Synergistic Smoothing
- 对基础检测分数进行中值平滑，同时利用扰动样本量化得分不稳定性。
- 在多个数据集上实现最高40 AUROC提升，对抗评分最小化和最大化攻击均表现稳健。
- 适合需要高可信度安全部署的场景，尤其对抗攻击风险高的应用。
可靠的分布外（OOD）检测是机器学习系统安全部署的关键需求。尽管近期取得进展，现有最先进的OOD检测器极易受到对抗攻击，削弱了其在自动化系统中的可信度。为解决这一漏洞，我们对基线OOD检测分数应用中值平滑，在保持正常与对抗准确率之间取得平衡。核心洞察在于，用于中值平滑的噪声样本可被重用于量化基线分数的局部不稳定性。我们观察到，分布外样本在扰动下表现出更高不稳定性。基于此，提出新型后处理式稳健OOD检测器ROSS，利用基线分数的不稳定性进一步区分分布内（ID）与分布外（OOD）样本。ROSS实现对称鲁棒性，相较于先前方法，在对抗评分最小化和最大化攻击下均表现更优，鲁棒性达到新高度，性能领先高达40 AUROC点。我们在CIFAR-10、CIFAR-100和ImageNet上进行了广泛实验，验证了该方法的有效性。代码已公开于：https://github.com/Abdu-Hekal/ROSS。
原文摘要 · Abstract (English)
Reliable out-of-distribution (OOD) detection is a critical requirement for the safe deployment of machine learning systems. Despite recent progress, state-of-the-art OOD detectors are highly susceptible to adversarial attacks, which undermines their trustworthiness in automated systems. To address this vulnerability, we apply median smoothing to baseline OOD detection scores, balancing clean and adversarial accuracies. Our key insight is that the noisy samples generated for median smoothing can be repurposed to quantify the local instability of the base score. We observe that OOD samples exhibit higher instability under perturbation. Based on this, we propose ROSS, a novel and robust post-hoc OOD detector that leverages the instability of baseline scores to further distinguish between in-distribution (ID) and OOD samples. ROSS achieves symmetric robustness, performing strongly against both score-minimising and score-maximising attacks, unlike prior work. This symmetric defence leads to state-of-the-art robustness, outperforming prior methods by up to 40 AUROC points. We demonstrate ROSS's effectiveness on extensive experiments across CIFAR-10, CIFAR-100, and ImageNet. Code is available at: https://github.com/Abdu-Hekal/ROSS.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。