量化使用投影梯度下降的对抗训练中模型梯度的偏好方向
Quantifying the Preferential Direction of the Model Gradient in Adversarial Training With Projected Gradient Descent
AI总结：
本文定义对抗训练后模型梯度的偏好方向，并提出基于生成对抗网络最小残差的对齐度量，证明PGD模型对齐更强且强化该对齐可提升鲁棒性。
摘要：
对抗训练，尤其是投影梯度下降（PGD），已被证明是提升针对对抗攻击鲁棒性的成功方法。对抗训练后，模型相对于其输入的梯度具有一个偏好方向。然而，这种对齐方向在数学上尚未得到充分确立，因此难以对其进行定量评估。我们提出了对该方向的一种新颖定义，即将其定义为在决策空间中指向最近的非正确类别支持集最近点的向量方向。为评估对抗训练后与该方向的对齐情况，我们采用了一种使用生成对抗网络生成改变图像中现有类别所需最小残差的指标。我们表明，根据我们的定义，经 PGD 训练的模型比基线具有更高的对齐度，我们的指标相较一种竞争性指标表述呈现出更高的对齐值，并且强制实现这种对齐会提升模型的鲁棒性。
英文摘要：
Adversarial training, especially projected gradient descent (PGD), has proven to be a successful approach for improving robustness against adversarial attacks. After adversarial training, gradients of models with respect to their inputs have a preferential direction. However, the direction of alignment is not mathematically well established, making it difficult to evaluate quantitatively. We propose a novel definition of this direction as the direction of the vector pointing toward the closest point of the support of the closest inaccurate class in decision space. To evaluate the alignment with this direction after adversarial training, we apply a metric that uses generative adversarial networks to produce the smallest residual needed to change the class present in the image. We show that PGD-trained models have a higher alignment than the baseline according to our definition, that our metric presents higher alignment values than a competing metric formulation, and that enforcing this alignment increases the robustness of models.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
