用数据稀疏性假设解释对抗性漏洞
Explaining Adversarial Vulnerability with a Data Sparsity Hypothesis
摘要：
尽管提出了许多算法来为深度学习（DL）模型提供鲁棒性，但DL模型仍然容易受到对抗攻击的影响。我们假设DL模型的对抗性脆弱性源于两个因素。第一个因素是数据稀疏性，即在高维输入数据空间中，存在数据分布支持之外的大区域。第二个因素是DL模型中存在许多冗余参数。由于这些因素，不同的模型能够得出不同的决策边界，具有较高的预测精度。决策边界出现在数据分布支持之外的空间中并不影响模型的预测精度。然而，它在模型的对抗鲁棒性方面有重要的区别。我们假设理想的决策边界是尽可能远离数据分布的支持。在本文中，我们开发了一个训练框架来观察DL模型是否能够学习这样一个决策边界，该边界跨越类分布周围的空间，进一步远离数据点本身。半监督学习在训练期间通过利用在数据分布的支持之外的空间中生成的未标记数据来部署。我们测量了使用这个训练框架训练的模型对众所周知的对抗攻击的对抗鲁棒性，并使用鲁棒性指标。我们发现，使用我们的框架训练的模型，以及其他正则化方法和对抗训练支持我们的数据稀疏性假设，并且使用这些方法训练的模型学习具有与上述理想决策边界更相似的决策边界。我们的培训框架代码可以在https://github.com/MahsaPaknezhad/AdversariallyRobustTraining上找到。
英文摘要：
Despite many proposed algorithms to provide robustness to deep learning (DL) models, DL models remain susceptible to adversarial attacks. We hypothesize that the adversarial vulnerability of DL models stems from two factors. The first factor is data sparsity which is that in the high dimensional input data space, there exist large regions outside the support of the data distribution. The second factor is the existence of many redundant parameters in the DL models. Owing to these factors, different models are able to come up with different decision boundaries with comparably high prediction accuracy. The appearance of the decision boundaries in the space outside the support of the data distribution does not affect the prediction accuracy of the model. However, it makes an important difference in the adversarial robustness of the model. We hypothesize that the ideal decision boundary is as far as possible from the support of the data distribution. In this paper, we develop a training framework to observe if DL models are able to learn such a decision boundary spanning the space around the class distributions further from the data points themselves. Semi-supervised learning was deployed during training by leveraging unlabeled data generated in the space outside the support of the data distribution. We measured adversarial robustness of the models trained using this training framework against well-known adversarial attacks and by using robustness metrics. We found that models trained using our framework, as well as other regularization methods and adversarial training support our hypothesis of data sparsity and that models trained with these methods learn to have decision boundaries more similar to the aforementioned ideal decision boundary. The code for our training framework is available at https://github.com/MahsaPaknezhad/AdversariallyRobustTraining.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
