以敌制敌
Combating Adversaries with Anti-Adversaries
摘要：
深度神经网络容易受到被称为对抗攻击的小输入扰动的影响。受这些对手是通过迭代最小化网络对真实类别标签的置信度来构建的这一事实的启发，我们提出了反对手层，旨在对抗这种影响。特别是，我们的层在对抗性输入的相反方向上生成输入扰动，并将输入的扰动版本馈送给分类器。我们的方法是无训练和理论支持的。我们通过将我们的层与名义上和鲁棒训练的模型相结合来验证我们方法的有效性，并对CIFAR10，CIFAR100和ImageNet进行从黑盒到自适应攻击的大规模实验。我们的层显着增强了模型的鲁棒性，同时在干净的准确性上没有任何成本。
英文摘要：
Deep neural networks are vulnerable to small input perturbations known as adversarial attacks. Inspired by the fact that these adversaries are constructed by iteratively minimizing the confidence of a network for the true class label, we propose the anti-adversary layer, aimed at countering this effect. In particular, our layer generates an input perturbation in the opposite direction of the adversarial one and feeds the classifier a perturbed version of the input. Our approach is training-free and theoretically supported. We verify the effectiveness of our approach by combining our layer with both nominally and robustly trained models and conduct large-scale experiments from black-box to adaptive attacks on CIFAR10, CIFAR100, and ImageNet. Our layer significantly enhances model robustness while coming at no cost on clean accuracy.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
