arXiv 2406.006852024-06-02cs.CVcs.LG

通过像素重加权对抗训练改进准确率-鲁棒性权衡

Improving Accuracy-robustness Trade-off via Pixel Reweighted Adversarial Training

School of Computing and Information Systems, The University of Melbourne（墨尔本大学计算与信息系统学院）；State Key Laboratory of Integrated Services Networks, Xidian University（西安电子科技大学）；School of Computer Science, The University of Auckland（奥克兰大学计算机科学学院）；RIKEN AIP（理化学研究所人工智能项目）；Sydney AI Centre, The University of Sydney（悉尼大学悉尼人工智能中心）

Jiacheng Zhang, Feng Liu, Dawei Zhou, Jingfeng Zhang, Tongliang Liu

阅读 PDF

arXiv 页面 ↗HTML 原文 ↗

AI总结：

本文提出像素重加权对抗训练（PART）框架，通过降低对较少影响力像素的扰动预算、保持关键区域的预算，在CIFAR-10、SVHN和TinyImagenet-200上提升准确率而不损害鲁棒性。

摘要：

对抗训练（AT）使用对抗样本（AEs）训练模型，这些样本是经过特定扰动修改以误导模型的自然图像。这些扰动受预定义的扰动预算 $ε$ 约束，并均等地应用于图像中的每个像素。然而，在本文中，我们发现并非所有像素对 AEs 的准确率（即鲁棒性）和自然图像的准确率（即准确率）的贡献相同。受此发现启发，我们提出了像素重加权对抗训练（PART），这是一种新框架，通过部分降低对较少影响力像素的 $ε$，引导模型更关注影响其输出的关键区域。具体而言，我们首先使用类激活映射（CAM）方法识别重要像素区域，然后在生成 AEs 时，保持这些区域的扰动预算，同时降低其余区域的预算。最后，我们使用这些像素重加权的 AEs 训练模型。PART 在 CIFAR-10、SVHN 和 TinyImagenet-200 上实现了准确率的显著提升，且未损害鲁棒性，证明了在鲁棒分类中为不同像素区域分配不同权重的必要性。

英文摘要：

Adversarial training (AT) trains models using adversarial examples (AEs), which are natural images modified with specific perturbations to mislead the model. These perturbations are constrained by a predefined perturbation budget $ε$ and are equally applied to each pixel within an image. However, in this paper, we discover that not all pixels contribute equally to the accuracy on AEs (i.e., robustness) and accuracy on natural images (i.e., accuracy). Motivated by this finding, we propose Pixel-reweighted AdveRsarial Training (PART), a new framework that partially reduces $ε$ for less influential pixels, guiding the model to focus more on key regions that affect its outputs. Specifically, we first use class activation mapping (CAM) methods to identify important pixel regions, then we keep the perturbation budget for these regions while lowering it for the remaining regions when generating AEs. In the end, we use these pixel-reweighted AEs to train a model. PART achieves a notable improvement in accuracy without compromising robustness on CIFAR-10, SVHN and TinyImagenet-200, justifying the necessity to allocate distinct weights to different pixel regions in robust classification.

机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。