arXivDaily arXiv每日学术速递 周一至周五更新
arXiv 2401.13751cs.LGcs.AIcs.CVstat.ML
收藏

一种用于推理与鲁棒性评估的训练速率与生存启发式方法（TRASHFIRE）

A Training Rate and Survival Heuristic for Inference and Robustness Evaluation (TRASHFIRE)

Umeå University（于默奥大学）；Elastisys AB（伊拉斯蒂斯公司）

Charles Meyers, Mohammad Reza Saleh Sedghpour, Tommy Löfstedt, Erik Elmroth

阅读 PDF
arXiv 页面 ↗HTML 原文 ↗

AI总结：

本研究提出结合生存模型、最坏情况样本与成本感知分析的TRASHFIRE方法，可在训练中评估模型对抗鲁棒性，发现深度模型的生存时间提升主要源于推理时间而非固有鲁棒性，且ResNet对简单白盒攻击完全不安全。

摘要：

机器学习模型，尤其是深度神经网络，已在众多领域的基准数据集上取得了极为出色的表现。然而，当模型训练时间以小时或天计量，而找到有效对抗样本的时间仅以秒计量时，对抗样本易于被发现的问题始终存在。已有大量研究致力于生成这类对抗样本并构建防御机制，但攻击与防御的相对成本却鲜少被探讨。此外，机器学习研究几乎完全由测试/训练指标驱动，而要达到行业标准，这类指标需要数十亿样本量支撑。\n本研究致力于解决的问题是：理解并预测特定模型超参数在存在对抗者的场景下如何影响模型性能。所提出的方法结合了生存模型、最坏情况样本与成本感知分析，能够在常规模型训练流程中精准、准确地否决特定的模型改动，无需依赖实际部署、成本高昂的形式化验证方法，或是对极为复杂系统的精确模拟（例如数字化重建汽车或飞机的所有部件）。\n通过对多种预处理技术、对抗样本以及神经网络配置的评估，研究得出结论：与较浅的同类模型相比，更深的模型确实在生存时间上带来了边际提升。但研究表明，这些提升更多是由模型推理时间驱动，而非模型固有的鲁棒性特性。利用所提出的方法，研究证实ResNet即便面对最简单的白盒攻击，也毫无安全性可言。

英文摘要：

Machine learning models -- deep neural networks in particular -- have performed remarkably well on benchmark datasets across a wide variety of domains. However, the ease of finding adversarial counter-examples remains a persistent problem when training times are measured in hours or days and the time needed to find a successful adversarial counter-example is measured in seconds. Much work has gone into generating and defending against these adversarial counter-examples, however the relative costs of attacks and defences are rarely discussed. Additionally, machine learning research is almost entirely guided by test/train metrics, but these would require billions of samples to meet industry standards. The present work addresses the problem of understanding and predicting how particular model hyper-parameters influence the performance of a model in the presence of an adversary. The proposed approach uses survival models, worst-case examples, and a cost-aware analysis to precisely and accurately reject a particular model change during routine model training procedures rather than relying on real-world deployment, expensive formal verification methods, or accurate simulations of very complicated systems (\textit{e.g.}, digitally recreating every part of a car or a plane). Through an evaluation of many pre-processing techniques, adversarial counter-examples, and neural network configurations, the conclusion is that deeper models do offer marginal gains in survival times compared to more shallow counterparts. However, we show that those gains are driven more by the model inference time than inherent robustness properties. Using the proposed methodology, we show that ResNet is hopelessly insecure against even the simplest of white box attacks.

机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。

↑