DVERGE：多样化漏洞以增强集成的鲁棒生成
DVERGE: Diversifying Vulnerabilities for Enhanced Robust Generation of Ensembles
摘要：
最近的研究发现，用于图像分类的CNN模型表现出重叠的对抗性漏洞：对抗攻击可以误导具有小扰动的CNN模型，这可以有效地在同一数据集上训练的不同模型之间进行转移。对抗性训练作为一种通用的鲁棒性改进技术，通过强制单个模型学习鲁棒特征来消除其脆弱性。这个过程很难，通常需要大容量的模型，并且在干净的数据准确性上有很大的损失。或者，提出集成方法来诱导具有不同输出的子模型对抗转移对抗性示例，使得集成对转移攻击具有鲁棒性，即使每个子模型单独地是非鲁棒的。在该过程中仅观察到小的清洁精度下降。然而，以前的集成训练方法在诱导这种多样性方面并不有效，因此在达到鲁棒集成方面无效。我们提出了DVERGE，它通过提取非鲁棒特征来隔离每个子模型中的对抗性漏洞，并使对抗性漏洞多样化，以诱导不同的输出来对抗转移攻击。新的多样性度量和训练过程，使DVERGE实现更高的鲁棒性对转移攻击相比，以前的集成方法，并使更多的子模型时，增加到集成的鲁棒性。该工作的代码可在https://github.com/zjysteven/DVERGE上获得
英文摘要：
Recent research finds CNN models for image classification demonstrate overlapped adversarial vulnerabilities: adversarial attacks can mislead CNN models with small perturbations, which can effectively transfer between different models trained on the same dataset. Adversarial training, as a general robustness improvement technique, eliminates the vulnerability in a single model by forcing it to learn robust features. The process is hard, often requires models with large capacity, and suffers from significant loss on clean data accuracy. Alternatively, ensemble methods are proposed to induce sub-models with diverse outputs against a transfer adversarial example, making the ensemble robust against transfer attacks even if each sub-model is individually non-robust. Only small clean accuracy drop is observed in the process. However, previous ensemble training methods are not efficacious in inducing such diversity and thus ineffective on reaching robust ensemble. We propose DVERGE, which isolates the adversarial vulnerability in each sub-model by distilling non-robust features, and diversifies the adversarial vulnerability to induce diverse outputs against a transfer attack. The novel diversity metric and training procedure enables DVERGE to achieve higher robustness against transfer attacks comparing to previous ensemble methods, and enables the improved robustness when more sub-models are added to the ensemble. The code of this work is available at https://github.com/zjysteven/DVERGE
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
