DAFAR：通过反馈-自编码器重构防御敌手
DAFAR: Defending against Adversaries by Feedback-Autoencoder Reconstruction
摘要：
深度学习在具有挑战性的感知任务上表现出令人印象深刻的性能，并已广泛应用于软件中，以提供智能服务。然而，研究人员发现，深度神经网络容易受到对抗性样本的影响。从那时起，提出了许多方法来防御输入中的对手，但它们要么依赖于攻击，要么对新的攻击无效。现有的技术大多具有复杂的结构或机制，导致过高的开销或延迟，不适用于实际软件。我们提出了DAFAR，这是一个反馈框架，允许深度学习模型以高效率和普适性检测/净化对抗性示例，同时具有低面积和时间开销。DAFAR有一个简单的结构，包含一个受害者模型，一个插件反馈网络和一个检测器。其核心思想是将受害者模型的特征提取层的高级特征导入反馈网络以重建输入。该数据流形成反馈自动编码器。对于强攻击，该算法将对受害者模型的不可感知攻击直接转化为对反馈自编码器的明显重构错误攻击，更容易检测;对于弱攻击，重构过程破坏了对抗性样本的结构。在MNIST和CIFAR-10数据集上进行的实验表明，DAFAR对流行的和可以说是最先进的攻击是有效的，而不会损失合法样本的性能，具有高有效性和跨攻击方法和参数的通用性。
英文摘要：
Deep learning has shown impressive performance on challenging perceptual tasks and has been widely used in software to provide intelligent services. However, researchers found deep neural networks vulnerable to adversarial examples. Since then, many methods are proposed to defend against adversaries in inputs, but they are either attack-dependent or shown to be ineffective with new attacks. And most of existing techniques have complicated structures or mechanisms that cause prohibitively high overhead or latency, impractical to apply on real software. We propose DAFAR, a feedback framework that allows deep learning models to detect/purify adversarial examples in high effectiveness and universality, with low area and time overhead. DAFAR has a simple structure, containing a victim model, a plug-in feedback network, and a detector. The key idea is to import the high-level features from the victim model's feature extraction layers into the feedback network to reconstruct the input. This data stream forms a feedback autoencoder. For strong attacks, it transforms the imperceptible attack on the victim model into the obvious reconstruction-error attack on the feedback autoencoder directly, which is much easier to detect; for weak attacks, the reformation process destroys the structure of adversarial examples. Experiments are conducted on MNIST and CIFAR-10 data-sets, showing that DAFAR is effective against popular and arguably most advanced attacks without losing performance on legitimate samples, with high effectiveness and universality across attack methods and parameters.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
