针对未预见对手的鲁棒性测试
Testing Robustness Against Unforeseen Adversaries
AI总结：
本文提出ImageNet-UA框架，包含十八种新的非L_p攻击，用于评估模型对训练中未预见对手的鲁棒性，并发现现有度量不足、替代训练策略更优及新方法可提升未预见鲁棒性。
摘要：
对抗鲁棒性研究主要关注L_p扰动，且大多数防御方法在训练时和测试时使用相同的对手。然而，在实际应用中，开发者不太可能预先了解其系统将面临的全部攻击或损坏类型。此外，最坏情况下的输入很可能是多样的，且不必局限于L_p球内。为了缩小研究与现实之间的这一差距，我们引入了ImageNet-UA，这是一个用于评估模型针对一系列未预见对手的鲁棒性的框架，其中包括十八种新的非L_p攻击。要在ImageNet-UA上表现良好，防御方法必须克服泛化差距，并对训练期间未遇到的各种攻击具有鲁棒性。在大量实验中，我们发现现有的鲁棒性度量无法捕捉未预见鲁棒性，标准鲁棒性技术被替代训练策略所超越，并且新方法可以提升未预见鲁棒性。我们将ImageNet-UA作为一个有用的工具呈现给社区，用于改善机器学习系统的最坏情况行为。
英文摘要：
Adversarial robustness research primarily focuses on L_p perturbations, and most defenses are developed with identical training-time and test-time adversaries. However, in real-world applications developers are unlikely to have access to the full range of attacks or corruptions their system will face. Furthermore, worst-case inputs are likely to be diverse and need not be constrained to the L_p ball. To narrow in on this discrepancy between research and reality we introduce ImageNet-UA, a framework for evaluating model robustness against a range of unforeseen adversaries, including eighteen new non-L_p attacks. To perform well on ImageNet-UA, defenses must overcome a generalization gap and be robust to a diverse attacks not encountered during training. In extensive experiments, we find that existing robustness measures do not capture unforeseen robustness, that standard robustness techniques are beat by alternative training strategies, and that novel methods can improve unforeseen robustness. We present ImageNet-UA as a useful tool for the community for improving the worst-case behavior of machine learning systems.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
