增强对抗训练中的鲁棒表示：对齐与排斥准则
Enhancing Robust Representation in Adversarial Training: Alignment and Exclusion Criteria
AI总结：
针对对抗训练忽略学习鲁棒特征的问题，提出基于排斥和对齐准则的通用框架，通过非对称负对比推开异类样本、反向注意力拉近同类样本，在三个基准数据集上实现了最先进的对抗鲁棒性。
摘要：
深度神经网络容易受到对抗噪声的攻击。对抗训练（Adversarial Training, AT）已被证明是保护神经网络免受欺骗的最有效防御策略。然而，我们发现AT忽略了学习鲁棒特征，导致对抗鲁棒性表现不佳。为了解决这个问题，我们强调了鲁棒表示的两个准则：（1）排斥：样本的特征远离其他类别的特征；（2）对齐：自然样本及其对应对抗样本的特征彼此接近。这些准则促使我们提出了一种通用的AT框架，通过非对称负对比和反向注意力来获得鲁棒表示。具体而言，我们设计了一种基于预测概率的非对称负对比方法，以在特征空间中推开不同类别的样本。此外，我们提出利用线性分类器的参数对特征进行加权作为反向注意力，以获取类别感知特征并拉近同一类别的特征。在三个基准数据集上的实证评估表明，我们的方法极大地提升了AT的鲁棒性，并取得了最先进的性能。
英文摘要：
Deep neural networks are vulnerable to adversarial noise. Adversarial Training (AT) has been demonstrated to be the most effective defense strategy to protect neural networks from being fooled. However, we find AT omits to learning robust features, resulting in poor performance of adversarial robustness. To address this issue, we highlight two criteria of robust representation: (1) Exclusion: \emph{the feature of examples keeps away from that of other classes}; (2) Alignment: \emph{the feature of natural and corresponding adversarial examples is close to each other}. These motivate us to propose a generic framework of AT to gain robust representation, by the asymmetric negative contrast and reverse attention. Specifically, we design an asymmetric negative contrast based on predicted probabilities, to push away examples of different classes in the feature space. Moreover, we propose to weight feature by parameters of the linear classifier as the reverse attention, to obtain class-aware feature and pull close the feature of the same class. Empirical evaluations on three benchmark datasets show our methods greatly advance the robustness of AT and achieve state-of-the-art performance.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
