利用空类限制决策空间并防御神经网络对抗攻击
Utilizing a null class to restrict decision spaces and defend against neural network adversarial attacks
摘要：
尽管最近取得了进展，但深度神经网络通常仍然容易受到所谓的对抗性示例的影响-输入图像具有小的扰动，可能导致输出分类的变化，尽管对人类观众的语义含义没有这种变化。即使对于像MNIST数字分类任务这样看似简单的挑战也是如此。在某种程度上，这表明这些网络并不依赖于人类用来进行这些分类的同一组对象特征。在本文中，我们研究了一个额外的，而且在很大程度上未被探索的，这种现象背后的原因-即，使用传统的训练范式，其中整个输入空间被包裹在训练类。由于这种范式，学习的决策空间的个别类跨越输入空间的过大的区域，并包括图像，没有语义相似性的图像在训练集中。在这项研究中，我们训练模型，包括一个空类。也就是说，模型可以“选择退出”将输入图像分类为数字类别之一。在训练过程中，通过各种方法创建空图像，试图为数字类创建更紧密和更有语义意义的决策空间。表现最好的模型将几乎所有对抗性样本分类为null，而不是将它们误认为是不正确的数字类的成员，同时在未扰动的测试集上保持高准确性。空类的使用和本文提出的训练范例可以为某些应用提供针对对抗攻击的有效防御。复制本研究的代码将在https://github.com/mattroos/null_class_adversarial_defense上提供。
英文摘要：
Despite recent progress, deep neural networks generally continue to be vulnerable to so-called adversarial examples--input images with small perturbations that can result in changes in the output classifications, despite no such change in the semantic meaning to human viewers. This is true even for seemingly simple challenges such as the MNIST digit classification task. In part, this suggests that these networks are not relying on the same set of object features as humans use to make these classifications. In this paper we examine an additional, and largely unexplored, cause behind this phenomenon--namely, the use of the conventional training paradigm in which the entire input space is parcellated among the training classes. Owing to this paradigm, learned decision spaces for individual classes span excessively large regions of the input space and include images that have no semantic similarity to images in the training set. In this study, we train models that include a null class. That is, models may "opt-out" of classifying an input image as one of the digit classes. During training, null images are created through a variety of methods, in an attempt to create tighter and more semantically meaningful decision spaces for the digit classes. The best performing models classify nearly all adversarial examples as nulls, rather than mistaking them as a member of an incorrect digit class, while simultaneously maintaining high accuracy on the unperturbed test set. The use of a null class and the training paradigm presented herein may provide an effective defense against adversarial attacks for some applications. Code for replicating this study will be made available at https://github.com/mattroos/null_class_adversarial_defense .
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
