一种评估机器学习分类器对抗距离的实用方法
A practical approach to evaluating the adversarial distance for machine learning classifiers
AI总结：
本文提出一种结合迭代对抗攻击与认证方法估计对抗距离上下界的实用评估方法，并通过可视化与消融研究验证其有效性，旨在推动更具信息量的ML分类器鲁棒性评估。
摘要：
鲁棒性对于机器学习（ML）分类器至关重要，以确保在模型可能遇到损坏或对抗性输入的实时应用中保持一致的性能。特别是，评估分类器对对抗性输入的鲁棒性对于保护系统免受漏洞影响并确保使用安全至关重要。然而，对于复杂的ML模型和高维数据，准确计算对抗鲁棒性的方法一直具有挑战性。此外，评估通常测量特定攻击预算下的对抗准确率，限制了所得指标的信息价值。本文研究了使用迭代对抗攻击和认证方法来估计更具信息量的对抗距离。结合使用，这些方法通过计算对抗距离的上界和下界估计，提供了对对抗鲁棒性的全面评估。我们展示了可视化结果和消融研究，为如何应用和参数化该评估方法提供了见解。我们发现，与相关实现相比，我们的对抗攻击方法是有效的，而认证方法未达到预期。本文的方法应鼓励以更具信息量的方式评估ML分类器的对抗鲁棒性。
英文摘要：
Robustness is critical for machine learning (ML) classifiers to ensure consistent performance in real-world applications where models may encounter corrupted or adversarial inputs. In particular, assessing the robustness of classifiers to adversarial inputs is essential to protect systems from vulnerabilities and thus ensure safety in use. However, methods to accurately compute adversarial robustness have been challenging for complex ML models and high-dimensional data. Furthermore, evaluations typically measure adversarial accuracy on specific attack budgets, limiting the informative value of the resulting metrics. This paper investigates the estimation of the more informative adversarial distance using iterative adversarial attacks and a certification approach. Combined, the methods provide a comprehensive evaluation of adversarial robustness by computing estimates for the upper and lower bounds of the adversarial distance. We present visualisations and ablation studies that provide insights into how this evaluation method should be applied and parameterised. We find that our adversarial attack approach is effective compared to related implementations, while the certification method falls short of expectations. The approach in this paper should encourage a more informative way of evaluating the adversarial robustness of ML classifiers.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
