arXivDaily arXiv每日学术速递 周一至周五更新
arXiv 2304.04033cs.LGcs.CRcs.CV

探索鲁棒模型与生成模型之间的联系

Exploring the Connection between Robust and Generative Models

Sapienza, University of Rome(罗马第一大学)

Senad Beadini, Iacopo Masi

AI总结:

本文揭示对抗训练分类器内部隐含 EBM 生成结构,并据此解释、检测无目标对抗样本,提出能量接近真实数据的 High-Energy PGD 攻击。

摘要:

我们提供了一项研究,将通过对抗训练(AT)训练的鲁棒判别式分类器与以基于能量的模型(EBM)形式呈现的生成建模联系起来。为此,我们分解了判别式分类器的损失,并证明判别式模型也能感知输入数据密度。尽管一种常见假设认为对抗点会离开输入数据流形,但我们的研究令人惊讶地发现,输入空间中的无目标对抗点极有可能位于判别式分类器内部隐藏的生成模型之下——即在 EBM 中具有较低能量。我们给出了两项证据:无目标攻击甚至比自然数据更可能出现这种情况,而且其可能性会随着攻击强度的增加而上升。这使我们能够轻松检测它们,并设计一种名为 High-Energy PGD 的新型攻击,该攻击可欺骗分类器,同时具有与数据集相似的能量。代码可在 github.com/senad96/Robust-Generative 获取。

英文摘要:

We offer a study that connects robust discriminative classifiers trained with adversarial training (AT) with generative modeling in the form of Energy-based Models (EBM). We do so by decomposing the loss of a discriminative classifier and showing that the discriminative model is also aware of the input data density. Though a common assumption is that adversarial points leave the manifold of the input data, our study finds out that, surprisingly, untargeted adversarial points in the input space are very likely under the generative model hidden inside the discriminative classifier -- have low energy in the EBM. We present two evidence: untargeted attacks are even more likely than the natural data and their likelihood increases as the attack strength increases. This allows us to easily detect them and craft a novel attack called High-Energy PGD that fools the classifier yet has energy similar to the data set. The code is available at github.com/senad96/Robust-Generative

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑