多少扰动能破坏这个模型？评估超越对抗准确率的鲁棒性
How many perturbations break this model? Evaluating robustness beyond adversarial accuracy
AI总结：
本文提出对抗稀疏性指标，用于量化在给定输入和扰动方向约束下找到成功扰动的难度，从而揭示准确率无法反映的鲁棒性差异，并证明数据增强可独立提升对抗鲁棒性。
摘要：
针对对抗攻击的鲁棒性通常用对抗准确率来评估。尽管这一指标必不可少，但它并未涵盖鲁棒性的所有方面，尤其没有回答对于每个样本点能够找到多少扰动这一问题。在本工作中，我们引入一种替代方法——对抗稀疏性，它在给定输入点和扰动方向约束的情况下，量化找到成功扰动的难度。我们表明，稀疏性能够以多种方式为神经网络提供有价值的见解：例如，它揭示了当前最先进的鲁棒模型之间存在的、准确率分析无法体现的重要差异，并提出了改进其鲁棒性的思路。当应用那些对弱攻击有效但对强攻击无效的失效防御时，稀疏性能够区分完全无效的防御和部分有效的防御。最后，借助稀疏性，我们可以衡量不影响准确率的鲁棒性提升：例如，我们表明数据增强本身就可以在不使用对抗训练的情况下提高对抗鲁棒性。
英文摘要：
Robustness to adversarial attacks is typically evaluated with adversarial accuracy. While essential, this metric does not capture all aspects of robustness and in particular leaves out the question of how many perturbations can be found for each point. In this work, we introduce an alternative approach, adversarial sparsity, which quantifies how difficult it is to find a successful perturbation given both an input point and a constraint on the direction of the perturbation. We show that sparsity provides valuable insight into neural networks in multiple ways: for instance, it illustrates important differences between current state-of-the-art robust models them that accuracy analysis does not, and suggests approaches for improving their robustness. When applying broken defenses effective against weak attacks but not strong ones, sparsity can discriminate between the totally ineffective and the partially effective defenses. Finally, with sparsity we can measure increases in robustness that do not affect accuracy: we show for example that data augmentation can by itself increase adversarial robustness, without using adversarial training.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
