Softmax输出如何误导评估对抗性示例的强度
How the Softmax Output is Misleading for Evaluating the Strength of Adversarial Examples
摘要：
甚至在深度学习架构成为复杂计算机视觉任务的事实模型之前，softmax函数就已经被用于分析前馈神经网络的预测。如今，softmax函数的输出也常用于评估对抗性示例的强度：恶意数据点旨在测试阶段使机器学习模型失败。然而，在本文中，我们证明了可以利用softmax函数的某些属性生成对抗性示例，从而在解释手头对抗性示例的强度时导致不期望的结果。具体来说，我们认为，当分析对抗性示例的强度时，softmax函数的输出是一个很差的指标，并且该指标很容易被现有的对抗性示例生成方法所欺骗。
英文摘要：
Even before deep learning architectures became the de facto models for complex computer vision tasks, the softmax function was, given its elegant properties, already used to analyze the predictions of feedforward neural networks. Nowadays, the output of the softmax function is also commonly used to assess the strength of adversarial examples: malicious data points designed to fail machine learning models during the testing phase. However, in this paper, we show that it is possible to generate adversarial examples that take advantage of some properties of the softmax function, leading to undesired outcomes when interpreting the strength of the adversarial examples at hand. Specifically, we argue that the output of the softmax function is a poor indicator when the strength of an adversarial example is analyzed and that this indicator can be easily tricked by already existing methods for adversarial example generation.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
