一个模型搞定所有攻击强度,实现动态自适应防御。
Towards One-for-All Robustness Across a Continuum of Threat Levels

- 用傅里叶嵌入和通道调制,让模型根据攻击强度自动调整。
- 单个模型在多个数据集上超越专用模型,参数仅多4.6%。
- 适合需要应对多种攻击场景的实时安全系统。
对抗鲁棒模型常对特定攻击预算过拟合,导致需多个专用模型应对不同威胁环境,随着威胁空间扩大,该策略变得不可行。本文提出威胁条件网络(TCN),基于表示分解框架,将表征学习分为与威胁无关的共享主干和轻量级威胁条件适配器。TCN通过傅里叶嵌入对扰动水平进行条件控制,并采用通道级仿射调制,在扰动预算分布上训练,使模型在推理时可无缝适应无限连续的威胁水平。在CIFAR-10、CIFAR-100和Tiny-ImageNet上的实验表明,TCN以单一参数集达到或超越一组预算专用模型的表现,能泛化至未见过的扰动预算,并在威胁不匹配条件下保持鲁棒性,参数仅增加4.6%。这些成果为动态多样威胁环境下的自适应、可泛化鲁棒性指明了新路径。
原文摘要 · Abstract (English)
Adversarially robust models often overfit to a specific attack budget, necessitating multiple specialized models for diverse and dynamic adversarial environments, a strategy that becomes fundamentally intractable as the threat space grows. This raises an open challenge: can we achieve strong robustness across a continuum of threat levels within a single model? We propose the Threat Conditional Network (TCN), grounded in a representation factorization framework that decomposes representation learning into a threat-invariant shared backbone and a lightweight threat-conditional adaptor. TCN conditions a single model on the perturbation level via Fourier-based embeddings and channel-wise affine modulation, and is trained against a distribution over perturbation budgets, enabling flexible and seamless adaptation across an infinite continuum of threat levels during inference. Extensive experiments on CIFAR-10, CIFAR-100, and Tiny-ImageNet show that TCN matches or surpasses a full ensemble of budget-specialized models with a single set of parameters, generalizes to unseen perturbation budgets, and transfers robustly under mismatched threat conditions, with only 4.6\% parameter overhead. These contributions chart a promising path toward adaptive and generalizable robustness in dynamic and diverse threat environments.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。