NERO-Net：一种用于设计对抗鲁棒卷积神经网络的神经进化方法
NERO-Net: A Neuroevolutionary Approach for the Design of Adversarially Robust CNNs
AI总结：
本文提出NERO-Net，通过神经进化方法设计更具抗攻击能力的CNN，通过隔离架构对鲁棒性的影响，提升模型在对抗攻击下的性能。
摘要：
神经进化自动化了神经网络设计的复杂任务，但通常忽视了进化模型固有的对抗脆弱性，这成为在安全关键场景中应用的障碍。尽管鲁棒训练方法受到广泛关注，但具有内在鲁棒性的架构设计仍鲜有探索。本文提出NERO-Net，一种神经进化方法，用于设计更能抵抗对抗攻击的卷积神经网络。我们的搜索策略通过在进化循环中避免对抗训练，隔离架构对鲁棒性的影响。因此，我们的适应度函数促进候选体，即使使用标准（非鲁棒）方法训练，也能在攻击后保持高准确率而不牺牲干净样本的准确率。我们在CIFAR-10上评估NERO-Net，特别关注$L_\infty$-鲁棒性。特别是，进化搜索中最优个体在对抗FGSM攻击时达到33%的准确率，作为搜索阶段的高效鲁棒性估计器，同时保持87%的干净样本准确率。进一步的标准训练使这些指标提升至47%的对抗准确率和93%的干净样本准确率，表明内在的架构鲁棒性。对抗训练使模型整体准确率提升至40%对抗AutoAttack。
英文摘要：
Neuroevolution automates the complex task of neural network design but often ignores the inherent adversarial fragility of evolved models which is a barrier to adoption in safety-critical scenarios. While robust training methods have received significant attention, the design of architectures exhibiting intrinsic robustness remains largely unexplored. In this paper, we propose NERO-Net, a neuroevolutionary approach to design convolutional neural networks better equipped to resist adversarial attacks. Our search strategy isolates architectural influence on robustness by avoiding adversarial training during the evolutionary loop. As such, our fitness function promotes candidates that, even trained with standard (non-robust) methods, achieve high post-attack accuracy without sacrificing the accuracy on clean samples. We assess NERO-Net on CIFAR-10 with a specific focus on $L_\infty$-robustness. In particular, the fittest individual emerged from evolutionary search with 33% accuracy against FGSM, used as an efficient estimator for robustness during the search phase, while maintaining 87% clean accuracy. Further standard training of this individual boosted these metrics to 47% adversarial and 93% clean accuracy, suggesting inherent architectural robustness. Adversarial training brings the overall accuracy of the model up to 40% against AutoAttack.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
