零牺牲持久鲁棒性对抗防御用于预训练编码器
Zero-Sacrifice Persistent-Robustness Adversarial Defense for Pre-Trained Encoders
AI总结：
本文提出零牺牲持久鲁棒性对抗防御方法，通过双分支结构实现对下游无关对抗性示例的高效防御，同时保持良性性能。
摘要：
公开可用的自监督学习（SSL）预训练编码器的广泛应用暴露了一个关键漏洞：它们对下游无关的对抗性示例（DAEs）的易受攻击性，这些示例在不了解下游任务的情况下被精心设计，能够误导下游模型。尽管最近已经探讨了几种防御方法，但它们主要依赖于任务特定的对抗性微调，这不可避免地限制了泛化能力，并导致灾难性遗忘和恶化良性性能。与先前的工作不同，我们提出了一种更严谨的防御目标，要求仅通过一次微调即可防御DAEs并保持良性性能。为了实现这一防御目标，我们引入了零牺牲持久鲁棒性对抗防御（ZePAD），其灵感来源于神经网络对数据特征的固有敏感性。具体而言，ZePAD是一种双分支结构，由多模式对抗增强分支（MPAE-Branch）和良性记忆保持分支（BMP-Branch）组成。MPAE-Branch使用两个对抗性微调的编码器来增强对抗性抗性，而BMP-Branch则在本地数据上进行训练，以确保对抗性鲁棒性不会损害良性性能。令人惊讶的是，我们发现ZePAD可以通过评估分支置信度直接检测DAEs，而无需在训练过程中引入任何对抗性示例识别任务。值得注意的是，通过丰富特征多样性，我们的方法使一次对抗性微调能够防御跨下游任务的DAEs，从而实现持久鲁棒性。在11种SSL方法和6个数据集上的广泛实验验证了其有效性。在某些情况下，它在良性性能上实现了29.20%的提升，在对抗性鲁棒性上实现了73.86%的提升，突显了其零牺牲特性。
英文摘要：
The widespread use of publicly available pre-trained encoders from self-supervised learning (SSL) has exposed a critical vulnerability: their susceptibility to downstream-agnostic adversarial examples (DAEs), which are crafted without knowledge of the downstream tasks but capable of misleading downstream models. While several defense methods have been explored recently, they rely primarily on task-specific adversarial fine-tuning, which inevitably limits generalizability and causes catastrophic forgetting and deteriorates benign performance. Different with previous works, we propose a more rigorous defense goal that requires only a single tuning for diverse downstream tasks to defend against DAEs and preserve benign performance. To achieve this defense goal, we introduce Zero-Sacrifice Persistent-Robustness Adversarial Defense (ZePAD), which is inspired by the inherent sensitivity of neural networks to data characteristics. Specifically, ZePAD is a dual-branch structure, which consists of a Multi-Pattern Adversarial Enhancement Branch (MPAE-Branch) that uses two adversarially fine-tuned encoders to strengthen adversarial resistance. The Benign Memory Preservation Branch (BMP-Branch) is trained on local data to ensure adversarial robustness does not compromise benign performance. Surprisingly, we find that ZePAD can directly detect DAEs by evaluating branch confidence, without introducing any adversarial exsample identification task during training. Notably, by enriching feature diversity, our method enables a single adversarial fine-tuning to defend against DAEs across downstream tasks, thereby achieving persistent robustness. Extensive experiments on 11 SSL methods and 6 datasets validate its effectiveness. In certain cases, it achieves a 29.20% improvement in benign performance and a 73.86% gain in adversarial robustness, highlighting its zero-sacrifice property.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
