鲁棒神经网络的信息损失优化
Optimizing Information Loss Towards Robust Neural Networks
摘要：
神经网络（NN）容易受到对抗性样本的影响。这样的输入与它们的良性对应物仅略有不同，但会引起被攻击NN的错误分类。制作示例所需的扰动通常可以忽略不计，甚至人类也无法察觉。为了保护基于深度学习的系统免受此类攻击，已经提出了几种对策，其中对抗训练仍然被认为是最有效的。在这里，使用对抗性示例迭代地重新训练NN，形成计算昂贵且耗时的过程，通常导致性能下降。为了克服对抗训练的缺点，同时仍然提供高级别的安全性，我们提出了一种新的训练方法，我们称之为\textit{entropic retraining}。基于信息论启发的分析，熵再训练模仿了对抗训练的效果，而不需要费力地生成对抗示例。我们的经验表明，熵再训练导致神经网络的安全性和鲁棒性显着增加，而只依赖于给定的原始数据。通过我们的原型实现，我们验证并展示了我们的方法对各种NN架构和数据集的有效性。
英文摘要：
Neural Networks (NNs) are vulnerable to adversarial examples. Such inputs differ only slightly from their benign counterparts yet provoke misclassifications of the attacked NNs. The required perturbations to craft the examples are often negligible and even human imperceptible. To protect deep learning-based systems from such attacks, several countermeasures have been proposed with adversarial training still being considered the most effective. Here, NNs are iteratively retrained using adversarial examples forming a computational expensive and time consuming process often leading to a performance decrease. To overcome the downsides of adversarial training while still providing a high level of security, we present a new training approach we call \textit{entropic retraining}. Based on an information-theoretic-inspired analysis, entropic retraining mimics the effects of adversarial training without the need of the laborious generation of adversarial examples. We empirically show that entropic retraining leads to a significant increase in NNs' security and robustness while only relying on the given original data. With our prototype implementation we validate and show the effectiveness of our approach for various NN architectures and data sets.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
