持续对抗防御
Continual Adversarial Defense
AI总结：
针对对抗攻击动态演化、现有防御易被绕过的问题，提出遵循四项实用原则的持续对抗防御（CAD）框架，整合多领域前沿技术，实验验证其对多阶段攻击的防御效果优于基线，且性能随攻击数增加趋于饱和，开辟了持续防御适配新范式。
摘要：
针对视觉分类器所面临的对抗攻击快速演化的特性，目前已有大量防御方法被提出，旨在尽可能泛化抵御更多已知攻击。然而，设计出能泛化应对所有类型攻击的防御方法并不现实，因为防御系统所处的运行环境是动态变化的。随着时间推移，必然会出现新的攻击，利用现有防御的漏洞将其绕过。因此，我们在一种符合实际的威胁模型下提出了持续防御策略，并首次引入了持续对抗防御（Continual Adversarial Defense，CAD）框架。CAD可在线持续收集对抗数据并适应不断演化的攻击序列，同时遵循四项实用原则：（1）持续适应新攻击且不发生灾难性遗忘；（2）少样本适应；（3）内存高效的适应；（4）在干净数据和对抗数据上均具备高分类准确率。我们探索并整合了持续学习、少样本学习和集成学习领域的前沿技术以满足上述原则。大量实验验证了我们的方法在应对多阶段对抗攻击时的有效性，且相较于各类基线方法均有显著提升。我们进一步观察到，随着攻击数量增加，CAD的防御性能趋于饱和，这表明当它适应了足够多样的攻击集合后，具备作为持久防御手段的潜力。我们的研究为应对动态演化攻击的持续防御适配提供了一种全新范式。
英文摘要：
In response to the rapidly evolving nature of adversarial attacks against visual classifiers, numerous defenses have been proposed to generalize against as many known attacks as possible. However, designing a defense method that generalizes to all types of attacks is unrealistic, as the environment in which the defense system operates is dynamic. Over time, new attacks inevitably emerge that exploit the vulnerabilities of existing defenses and bypass them. Therefore, we propose a continual defense strategy under a practical threat model and, for the first time, introduce the Continual Adversarial Defense (CAD) framework. CAD continuously collects adversarial data online and adapts to evolving attack sequences, while adhering to four practical principles: (1) continual adaptation to new attacks without catastrophic forgetting, (2) few-shot adaptation, (3) memory-efficient adaptation, and (4) high classification accuracy on both clean and adversarial data. We explore and integrate cutting-edge techniques from continual learning, few-shot learning, and ensemble learning to fulfill the principles. Extensive experiments validate the effectiveness of our approach against multi-stage adversarial attacks and demonstrate significant improvements over a wide range of baseline methods. We further observe that CAD's defense performance tends to saturate as the number of attacks increases, indicating its potential as a persistent defense once adapted to a sufficiently diverse set of attacks. Our research sheds light on a brand-new paradigm for continual defense adaptation against dynamic and evolving attacks.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
