自适应批归一化网络用于对抗鲁棒性
Adaptive Batch Normalization Networks for Adversarial Robustness
AI总结：
本文提出自适应批归一化网络（ABNN），利用预训练替代模型生成干净统计量，使目标模型在干净数据上训练并对齐，从而在不使用对抗训练的情况下，提升对数字和物理攻击的鲁棒性，同时提高干净数据性能并降低训练成本。
摘要：
深度网络容易受到对抗样本的攻击。对抗训练（AT）因其显著的有效性，已成为现代对抗防御方法的标准基础。然而，对抗训练极其耗时，这阻碍了其在实际应用中的广泛部署。在本文中，我们旨在探索一种非对抗训练的防御方法：如何设计一种摆脱对抗训练但仍能抵御强对抗攻击的防御方法？为了回答这个问题，我们借鉴了测试时域自适应领域的最新进展，求助于自适应批归一化（BN）。据此，我们提出了一种新颖的防御方法，称为自适应批归一化网络（ABNN）。ABNN使用一个预训练的替代模型来生成干净的BN统计量，并将其发送给目标模型。目标模型仅在干净数据上训练，并学习对齐替代模型的BN统计量。实验结果表明，ABNN在图像和视频数据集上，针对数字攻击和物理可实现攻击，均能持续提升对抗鲁棒性。此外，与基于对抗训练的方法相比，ABNN能够实现更高的干净数据性能，并显著降低训练时间复杂度。
英文摘要：
Deep networks are vulnerable to adversarial examples. Adversarial Training (AT) has been a standard foundation of modern adversarial defense approaches due to its remarkable effectiveness. However, AT is extremely time-consuming, refraining it from wide deployment in practical applications. In this paper, we aim at a non-AT defense: How to design a defense method that gets rid of AT but is still robust against strong adversarial attacks? To answer this question, we resort to adaptive Batch Normalization (BN), inspired by the recent advances in test-time domain adaptation. We propose a novel defense accordingly, referred to as the Adaptive Batch Normalization Network (ABNN). ABNN employs a pre-trained substitute model to generate clean BN statistics and sends them to the target model. The target model is exclusively trained on clean data and learns to align the substitute model's BN statistics. Experimental results show that ABNN consistently improves adversarial robustness against both digital and physically realizable attacks on both image and video datasets. Furthermore, ABNN can achieve higher clean data performance and significantly lower training time complexity compared to AT-based approaches.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
