通过门控批归一化防御多种 $\ell_p$ 范数有界对抗扰动
Towards Defending Multiple $\ell_p$-norm Bounded Adversarial Perturbations via Gated Batch Normalization
AI总结：
本文提出门控批归一化（GBN），利用多分支 BN 和门控子网络分离不同 $\ell_p$ 扰动统计特性，学习扰动不变表示，在多个数据集上显著提升对 $\ell_1$、$\ell_2$、$\ell_{\infty}$ 对抗攻击的鲁棒性。
摘要：
已有大量证据表明深度神经网络容易受到对抗样本的攻击，这推动了针对对抗攻击的防御方法研究。现有的对抗防御通常只提升模型对单一特定扰动类型（例如 $\ell_{\infty}$ 范数有界对抗样本）的鲁棒性。然而，在实际中攻击者很可能生成多种类型的扰动（例如 $\ell_1$、$\ell_2$ 和 $\ell_{\infty}$ 扰动）。近期一些方法尝试提升模型在多个 $\ell_p$ 球内对抗攻击下的鲁棒性，但它们在每种扰动类型上的表现仍远不能令人满意。本文中，我们观察到不同的 $\ell_p$ 有界对抗扰动会诱导出不同的统计特性，这些特性可以通过批归一化（Batch Normalization，BN）的统计量进行分离和刻画。为此，我们提出门控批归一化（Gated Batch Normalization，GBN），以对抗训练方式学习一个对扰动类型不变的预测器，用于防御多种 $\ell_p$ 有界对抗扰动。GBN 由一个多分支 BN 层和一个门控子网络组成。GBN 中的每个 BN 分支负责一种扰动类型，以确保归一化输出朝着学习扰动不变表示的方向对齐。同时，门控子网络被设计用于分离添加了不同扰动类型的输入。我们在常用数据集 MNIST、CIFAR-10 和 Tiny-ImageNet 上对所提方法进行了广泛评估，并证明 GBN 在防御多种扰动类型（即 $\ell_1$、$\ell_2$ 和 $\ell_{\infty}$ 扰动）方面以较大幅度优于此前的防御方案。
英文摘要：
There has been extensive evidence demonstrating that deep neural networks are vulnerable to adversarial examples, which motivates the development of defenses against adversarial attacks. Existing adversarial defenses typically improve model robustness against individual specific perturbation types (\eg, $\ell_{\infty}$-norm bounded adversarial examples). However, adversaries are likely to generate multiple types of perturbations in practice (\eg, $\ell_1$, $\ell_2$, and $\ell_{\infty}$ perturbations). Some recent methods improve model robustness against adversarial attacks in multiple $\ell_p$ balls, but their performance against each perturbation type is still far from satisfactory. In this paper, we observe that different $\ell_p$ bounded adversarial perturbations induce different statistical properties that can be separated and characterized by the statistics of Batch Normalization (BN). We thus propose Gated Batch Normalization (GBN) to adversarially train a perturbation-invariant predictor for defending multiple $\ell_p$ bounded adversarial perturbations. GBN consists of a multi-branch BN layer and a gated sub-network. Each BN branch in GBN is in charge of one perturbation type to ensure that the normalized output is aligned towards learning perturbation-invariant representation. Meanwhile, the gated sub-network is designed to separate inputs added with different perturbation types. We perform an extensive evaluation of our approach on commonly-used dataset including MNIST, CIFAR-10, and Tiny-ImageNet, and demonstrate that GBN outperforms previous defense proposals against multiple perturbation types (\ie, $\ell_1$, $\ell_2$, and $\ell_{\infty}$ perturbations) by large margins.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
