评估“处处集成”防御的鲁棒性
Evaluating the Robustness of the "Ensemble Everything Everywhere" Defense
AI总结：
本文证明“处处集成”防御存在严重梯度掩蔽问题，并通过自适应攻击将其在CIFAR-100和CIFAR-10上的鲁棒准确率分别从48%降至14%和从62%降至11%，表明该防御并不鲁棒。
摘要：
“处处集成”是一种最近提出的用于使图像分类器具有鲁棒性的对抗样本防御方法。该防御通过在多个带噪声的图像分辨率下集成模型的中间表示，产生单一鲁棒分类结果。该防御被证明对多种最先进的攻击有效。也许更有说服力的是，研究表明该模型的梯度具有感知对齐性：针对该模型的攻击产生的噪声在感知上类似于目标类别。在这篇简短的报告中，我们表明该防御对对抗攻击并不鲁棒。我们首先表明该防御的随机性和集成方法导致严重的梯度掩蔽。然后我们使用标准的自适应攻击技术，在 $\ell_\infty$-范数威胁模型下，$\varepsilon=8/255$，将该防御在 CIFAR-100 上的鲁棒准确率从 48% 降低到 14%，在 CIFAR-10 上从 62% 降低到 11%。
英文摘要：
Ensemble everything everywhere is a defense to adversarial examples that was recently proposed to make image classifiers robust. This defense works by ensembling a model's intermediate representations at multiple noisy image resolutions, producing a single robust classification. This defense was shown to be effective against multiple state-of-the-art attacks. Perhaps even more convincingly, it was shown that the model's gradients are perceptually aligned: attacks against the model produce noise that perceptually resembles the targeted class. In this short note, we show that this defense is not robust to adversarial attack. We first show that the defense's randomness and ensembling method cause severe gradient masking. We then use standard adaptive attack techniques to reduce the defense's robust accuracy from 48% to 14% on CIFAR-100 and from 62% to 11% on CIFAR-10, under the $\ell_\infty$-norm threat model with $\varepsilon=8/255$.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
