关于语义分割模型对抗鲁棒性的评估
On Evaluating the Adversarial Robustness of Semantic Segmentation Models
AI总结：
本文提出一组基于梯度的迭代攻击方法评估语义分割模型对抗鲁棒性，揭示以往声称鲁棒的模型实际并不鲁棒，并发现仅用对抗样本训练虽能提升鲁棒性但会牺牲准确性。
摘要：
在机器学习中，实现对对抗性输入扰动的鲁棒性是一个重要且引人入胜的问题。在语义图像分割领域，尽管已提出多种对抗训练方法作为对抗扰动的防御手段，但与图像分类相比，评估模型鲁棒性的方法学仍然欠缺。在此，我们证明，正如在图像分类中一样，在多种不同且困难的攻击下评估模型至关重要。我们提出了一组基于梯度的迭代攻击，并表明执行大量迭代是必不可少的。我们还包括针对模型内部表示的攻击。我们应用了两类攻击：在有界扰动下最大化误差，以及在给定误差水平下最小化扰动。利用这组攻击，我们首次表明，先前工作中许多声称具有鲁棒性的模型实际上根本不鲁棒。随后，我们评估了简单的对抗训练算法，这些算法即使在我们这组强攻击下也能产生相当鲁棒的模型。我们的结果表明，实现任何鲁棒性的一个关键设计决策是仅在训练期间使用对抗样本。然而，这引入了鲁棒性与准确性之间的权衡。
英文摘要：
Achieving robustness against adversarial input perturbation is an important and intriguing problem in machine learning. In the area of semantic image segmentation, a number of adversarial training approaches have been proposed as a defense against adversarial perturbation, but the methodology of evaluating the robustness of the models is still lacking, compared to image classification. Here, we demonstrate that, just like in image classification, it is important to evaluate the models over several different and hard attacks. We propose a set of gradient based iterative attacks and show that it is essential to perform a large number of iterations. We include attacks against the internal representations of the models as well. We apply two types of attacks: maximizing the error with a bounded perturbation, and minimizing the perturbation for a given level of error. Using this set of attacks, we show for the first time that a number of models in previous work that are claimed to be robust are in fact not robust at all. We then evaluate simple adversarial training algorithms that produce reasonably robust models even under our set of strong attacks. Our results indicate that a key design decision to achieve any robustness is to use only adversarial examples during training. However, this introduces a trade-off between robustness and accuracy.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
