类条件变换用于增强鲁棒图像分类
Class-Conditioned Transformation for Enhanced Robust Image Classification
AI总结：
提出测试时威胁模型无关算法CODIP，通过条件图像变换和距离预测增强对抗训练模型，无需额外训练，在多个数据集上显著提升鲁棒准确率。
摘要：
鲁棒分类方法主要集中于针对特定威胁模型的算法，导致对其他威胁模型的防御无效。现实应用面临此漏洞，因为恶意攻击者可能利用替代威胁模型。在本工作中，我们提出一种新颖的测试时威胁模型无关算法，以增强对抗训练（AT）模型。我们的方法通过条件图像变换和基于距离的预测（CODIP）运作，包含两个主要步骤：首先，我们将输入图像变换到每个数据集类别，其中输入图像可能是干净的或被攻击的。接下来，我们基于最短变换距离进行预测。条件变换利用AT模型所拥有的感知对齐梯度属性，从而无需额外模型或额外训练。此外，它允许用户在不训练的情况下选择干净准确率与鲁棒准确率之间的期望平衡。所提出的方法在多种模型、AT方法、数据集和攻击类型上通过广泛实验展示了最先进的结果。值得注意的是，应用CODIP在CIFAR10、CIFAR100、ImageNet和Flowers数据集上分别带来了高达+23%、+20%、+26%和+22%的鲁棒准确率显著提升。
英文摘要：
Robust classification methods predominantly concentrate on algorithms that address a specific threat model, resulting in ineffective defenses against other threat models. Real-world applications are exposed to this vulnerability, as malicious attackers might exploit alternative threat models. In this work, we propose a novel test-time threat model agnostic algorithm that enhances Adversarial-Trained (AT) models. Our method operates through COnditional image transformation and DIstance-based Prediction (CODIP) and includes two main steps: First, we transform the input image into each dataset class, where the input image might be either clean or attacked. Next, we make a prediction based on the shortest transformed distance. The conditional transformation utilizes the perceptually aligned gradients property possessed by AT models and, as a result, eliminates the need for additional models or additional training. Moreover, it allows users to choose the desired balance between clean and robust accuracy without training. The proposed method achieves state-of-the-art results demonstrated through extensive experiments on various models, AT methods, datasets, and attack types. Notably, applying CODIP leads to substantial robust accuracy improvement of up to $+23\%$, $+20\%$, $+26\%$, and $+22\%$ on CIFAR10, CIFAR100, ImageNet and Flowers datasets, respectively.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
