arXivDaily arXiv每日学术速递 周一至周五更新
arXiv 1902.07906cs.LGstat.ML
收藏

基于投影Sinkhorn迭代的Wasserstein对抗示例

Wasserstein Adversarial Examples via Projected Sinkhorn Iterations

Carnegie Mellon University(卡内基梅隆大学);Bosch Center for Artificial Intelligence(博世人工智能中心)

Eric Wong, Frank R. Schmidt, J. Zico Kolter

摘要:

一个快速增长的工作领域已经研究了对抗性示例的存在,即被扰动以欺骗分类器的数据点,但绝大多数这些工作主要集中在由$\ell_p$范数有界扰动定义的威胁模型上。提出了一种基于Wasserstein距离的对抗攻击威胁模型。在图像分类设置中,这样的距离测量移动像素质量的成本,这自然涵盖“标准”图像操作,例如缩放、旋转、平移和失真(并且也可以潜在地应用于其他设置)。为了生成Wasserstein对抗示例,我们开发了一个基于Sinkhorn迭代修改版本的投影到Wasserstein球上的程序。由此产生的算法可以成功地攻击图像分类模型,使传统的CIFAR10模型在半径为0.1的Wasserstein球内的准确率降低到3%(即,移动10%的图像质量1像素),我们证明了基于PGD的对抗训练可以将这种对抗准确率提高到76%。总的来说,这项工作开辟了对抗鲁棒性研究的新方向,更正式地考虑凸度量,准确地捕捉我们通常认为应该存在于分类器中的不变性。论文中所有实验的代码都可以在https://github.com/locuslab/projected_sinkhorn上找到。

英文摘要:

A rapidly growing area of work has studied the existence of adversarial examples, datapoints which have been perturbed to fool a classifier, but the vast majority of these works have focused primarily on threat models defined by $\ell_p$ norm-bounded perturbations. In this paper, we propose a new threat model for adversarial attacks based on the Wasserstein distance. In the image classification setting, such distances measure the cost of moving pixel mass, which naturally cover "standard" image manipulations such as scaling, rotation, translation, and distortion (and can potentially be applied to other settings as well). To generate Wasserstein adversarial examples, we develop a procedure for projecting onto the Wasserstein ball, based upon a modified version of the Sinkhorn iteration. The resulting algorithm can successfully attack image classification models, bringing traditional CIFAR10 models down to 3% accuracy within a Wasserstein ball with radius 0.1 (i.e., moving 10% of the image mass 1 pixel), and we demonstrate that PGD-based adversarial training can improve this adversarial accuracy to 76%. In total, this work opens up a new direction of study in adversarial robustness, more formally considering convex metrics that accurately capture the invariances that we typically believe should exist in classifiers. Code for all experiments in the paper is available at https://github.com/locuslab/projected_sinkhorn.

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑