LAFEAT：穿透具有潜在特征的对抗性防御
LAFEAT: Piercing Through Adversarial Defenses with Latent Features
摘要：
深度卷积神经网络易受对抗攻击的影响。它们很容易被欺骗，通过在输入中添加微小的扰动来给出错误的输出。这在使CNN对此类攻击具有鲁棒性方面提出了巨大挑战。为此，人们提出了大量新的防御技术。在本文中，我们表明，在某些“鲁棒”模型的潜在功能是令人惊讶的容易受到对抗攻击。在此之上，我们引入了一个统一的$\ell_\infty$规范白盒攻击算法，利用潜在的功能，在其梯度下降的步骤，即LAFEAT。我们表明，它不仅在计算上更有效地成功攻击，但它也是一个更强大的对手比目前的最先进的各种防御机制。这表明，模型的鲁棒性可能取决于防御者隐藏组件的有效使用，而不应该再从整体的角度来看待。
英文摘要：
Deep convolutional neural networks are susceptible to adversarial attacks. They can be easily deceived to give an incorrect output by adding a tiny perturbation to the input. This presents a great challenge in making CNNs robust against such attacks. An influx of new defense techniques have been proposed to this end. In this paper, we show that latent features in certain "robust" models are surprisingly susceptible to adversarial attacks. On top of this, we introduce a unified $\ell_\infty$-norm white-box attack algorithm which harnesses latent features in its gradient descent steps, namely LAFEAT. We show that not only is it computationally much more efficient for successful attacks, but it is also a stronger adversary than the current state-of-the-art across a wide range of defense mechanisms. This suggests that model robustness could be contingent on the effective use of the defender's hidden components, and it should no longer be viewed from a holistic perspective.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
