arXivDaily arXiv每日学术速递 周一至周五更新
arXiv 2011.09526cs.CV
收藏

用于对抗性鲁棒性的上下文融合

Contextual Fusion For Adversarial Robustness

University of California, San Diego(加州大学圣地亚哥分校)

Aiswarya Akumalla, Seth Haney, Maksim Bazhenov

摘要:

哺乳动物的大脑以完形的方式处理复杂的推理任务,通过整合来自大脑区域的信息,这些区域专门用于个人的感觉方式。这允许改进的鲁棒性和更好的泛化能力。相比之下,深度神经网络通常被设计为处理一个特定的信息流,并且容易受到各种类型的对抗性扰动的影响。虽然有许多方法可以检测和防御对抗攻击,但它们不能概括一系列攻击,并且会对干净、未受干扰的数据的性能产生负面影响。我们使用从Places-CNN和Imagenet-CNN并行提取的背景和前景特征的组合开发了一个融合模型。我们测试了融合方法在保持人类可感知的对抗鲁棒性方面的益处(例如,高斯模糊)和网络可感知(例如,基于梯度的)攻击CIFAR-10和MS COCO数据集。对于基于梯度的攻击,我们的研究结果表明,融合可以显着改善分类,而不会降低未扰动数据的性能,也不需要进行对抗性再训练。我们的融合模型也显示了高斯模糊类型扰动的改进。融合方法的性能提高取决于图像上下文的可变性;对于上下文差异较大的图像类别,可以看到较大的增加。我们还展示了正则化的效果,在存在已知对手的情况下偏向分类器的决定。我们提出,这种生物启发的方法可以整合多种模式的信息,提供了一种新的方法来提高对抗鲁棒性,可以补充目前最先进的方法。

英文摘要:

Mammalian brains handle complex reasoning tasks in a gestalt manner by integrating information from regions of the brain that are specialised to individual sensory modalities. This allows for improved robustness and better generalisation ability. In contrast, deep neural networks are usually designed to process one particular information stream and susceptible to various types of adversarial perturbations. While many methods exist for detecting and defending against adversarial attacks, they do not generalise across a range of attacks and negatively affect performance on clean, unperturbed data. We developed a fusion model using a combination of background and foreground features extracted in parallel from Places-CNN and Imagenet-CNN. We tested the benefits of the fusion approach on preserving adversarial robustness for human perceivable (e.g., Gaussian blur) and network perceivable (e.g., gradient-based) attacks for CIFAR-10 and MS COCO data sets. For gradient based attacks, our results show that fusion allows for significant improvements in classification without decreasing performance on unperturbed data and without need to perform adversarial retraining. Our fused model revealed improvements for Gaussian blur type perturbations as well. The increase in performance from fusion approach depended on the variability of the image contexts; larger increases were seen for classes of images with larger differences in their contexts. We also demonstrate the effect of regularization to bias the classifier decision in the presence of a known adversary. We propose that this biologically inspired approach to integrate information across multiple modalities provides a new way to improve adversarial robustness that can be complementary to current state of the art approaches.

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑