论文标题
实现自然鲁棒性，以抗击对抗性例子
Towards Natural Robustness Against Adversarial Examples
论文作者
论文摘要
最近的研究表明，深层神经网络容易受到对抗性例子的影响，但是针对防御对抗性实例提出的大多数方法无法从根本上解决这一问题。在本文中，我们从理论上证明，具有身份映射的神经网络有一个上限，以限制对抗性噪声引起的误差。但是，在实际计算中，这种神经网络不再具有任何上限，因此容易受到对抗示例的影响。按照类似的程序，我们解释了为什么对抗性示例可以欺骗其他具有跳过连接的深层神经网络。此外，我们证明了一个称为神经odes的新的深神网络家族（Chen等，2018）具有较弱的上限。这种较弱的上限阻止了结果的变化量太大。因此，神经OD具有自然的鲁棒性，以对抗对抗性例子。我们评估了与三个白色框对抗攻击（FGSM，PGD，DI2-FGSM）和一个黑盒对抗攻击（边界攻击）相比，与RESNET相比，我们评估了神经ODE的性能。最后，我们表明，神经ODE的自然鲁棒性甚至比接受过对抗性训练方法（例如Trade and Yopo）训练的神经网络的鲁棒性更好。
Recent studies have shown that deep neural networks are vulnerable to adversarial examples, but most of the methods proposed to defense adversarial examples cannot solve this problem fundamentally. In this paper, we theoretically prove that there is an upper bound for neural networks with identity mappings to constrain the error caused by adversarial noises. However, in actual computations, this kind of neural network no longer holds any upper bound and is therefore susceptible to adversarial examples. Following similar procedures, we explain why adversarial examples can fool other deep neural networks with skip connections. Furthermore, we demonstrate that a new family of deep neural networks called Neural ODEs (Chen et al., 2018) holds a weaker upper bound. This weaker upper bound prevents the amount of change in the result from being too large. Thus, Neural ODEs have natural robustness against adversarial examples. We evaluate the performance of Neural ODEs compared with ResNet under three white-box adversarial attacks (FGSM, PGD, DI2-FGSM) and one black-box adversarial attack (Boundary Attack). Finally, we show that the natural robustness of Neural ODEs is even better than the robustness of neural networks that are trained with adversarial training methods, such as TRADES and YOPO.
