arXiv:2606.17540cs.CV2026-06

针对多种攻击类型,提出频域解耦防御方法,显著提升模型鲁棒性。

TaFD: Threat-Aware Frequency Decoupling for Adversarial Robustness against Heterogeneous Attacks

论文配图:TaFD: Threat-Aware Frequency Decoupling for Adversarial Robustness against Heterogeneous Attacks
图 1 · 摘自论文原文
  • 通过频域分析分离不同攻击的特征,采用分治策略应对异构攻击
  • 在三个数据集上平均鲁棒准确率提升约11%,优于现有方法
  • 适合需要抵御多种对抗攻击的高安全场景使用

多威胁鲁棒性仍是深度学习中的核心挑战。尽管联合对抗训练(JAT)被广泛采用,但在异构威胁下仍存在负向迁移问题,尤其在ℓ_p有界攻击与语义攻击之间。通过一阶梯度分析,我们将其形式化为梯度不兼容,并理论证明了解耦优化的必要性。进一步发现,这些冲突威胁在频域中具有可分离的谱特性。受此启发,我们提出威胁感知频域解耦(TaFD),一种两阶段防御框架,将JAT重构为频域上的分治范式。TaFD首先通过无监督聚类识别潜在威胁域,并训练轻量分类器用于推理时威胁域判断;根据预测结果,采用频域条件卷积学习威胁域特定的频谱掩码,并将样本路由至对应专家,实现结构参数分离,缓解优化冲突。我们在三个代表性图像分类基准(CIFAR-10、CIFAR-100、Tiny-ImageNet)和两种架构(卷积型ResNet与混合式Transformer MobileViT)上验证了该方法。大量实验表明,与现有JAT及频域基线相比,TaFD在异构攻击下实现了更均衡的鲁棒性,平均鲁棒准确率较最强基线提升约11%,同时保持领先的干净准确率。

原文摘要 · Abstract (English)

Multi-threat robustness remains a fundamental challenge in deep learning. Although joint adversarial training (JAT) is widely adopted, it suffers from negative transfer under heterogeneous threats, particularly between $\ell_p$-bounded and semantic attacks. Through first-order gradient analysis, we formalize this as gradient incompatibility and theoretically establish the necessity of decoupled optimization. We further reveal that these conflicting threats exhibit separable spectral characteristics in the frequency domain. Motivated by this observation, we propose Threat-aware Frequency Decoupling (TaFD), a two-stage defense framework that reformulates JAT as a frequency-domain divide-and-conquer paradigm. TaFD first discovers latent threat domains via unsupervised clustering of attack spectral prototypes and trains a lightweight classifier for inference-time threat domain identification. Conditioned on the prediction, TaFD employs a Frequency-Conditional Convolution that learns threat-domain-specific spectral masks and routes each sample to the corresponding expert, enforcing structural parameter separation and alleviating optimization conflicts. We validate TaFD on three representative image-classification benchmarks (CIFAR-10, CIFAR-100, and Tiny-ImageNet) and on two representative architectures (the convolutional ResNet and the hybrid-transformer MobileViT). Extensive results demonstrate that TaFD achieves more balanced robustness against heterogeneous attacks than existing JAT and frequency-domain baselines, improving average robust accuracy by approximately 11\% over the strongest baseline while maintaining leading clean accuracy.

对抗鲁棒性频域分析多攻击防御

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。