论文标题
重新思考的特征不确定性在随机神经网络中，以实现对抗性鲁棒性
Rethinking Feature Uncertainty in Stochastic Neural Networks for Adversarial Robustness
论文作者
论文摘要
众所周知，深度神经网络（DNN）在许多领域都表现出了杰出的成功。但是，当在模型输入上添加不可察觉的幅度扰动时，模型性能可能会迅速降低。为了解决这个问题，最近提出了一种随机性技术，称为随机神经网络（SNNS）。具体而言，SNN将随机性注入模型，以防御看不见的攻击并改善对抗性的鲁棒性。但是，存在对SNN的研究主要集中于注入固定或可学习的噪声以建模权重/激活。在本文中，我们发现存在的SNN表演在很大程度上被功能表示能力所瓶颈。令人惊讶的是，只需最大化特征分布的每个维度方差，就会超出所有以前的方法，我们将其命名为最大化特征分布方差随机神经网络（MFDV-SNN）。关于著名的白色和黑盒攻击的广泛实验表明，MFDV-SNN比现有方法取得了重大改进，这表明这是提高模型鲁棒性的一种简单但有效的方法。
It is well-known that deep neural networks (DNNs) have shown remarkable success in many fields. However, when adding an imperceptible magnitude perturbation on the model input, the model performance might get rapid decrease. To address this issue, a randomness technique has been proposed recently, named Stochastic Neural Networks (SNNs). Specifically, SNNs inject randomness into the model to defend against unseen attacks and improve the adversarial robustness. However, existed studies on SNNs mainly focus on injecting fixed or learnable noises to model weights/activations. In this paper, we find that the existed SNNs performances are largely bottlenecked by the feature representation ability. Surprisingly, simply maximizing the variance per dimension of the feature distribution leads to a considerable boost beyond all previous methods, which we named maximize feature distribution variance stochastic neural network (MFDV-SNN). Extensive experiments on well-known white- and black-box attacks show that MFDV-SNN achieves a significant improvement over existing methods, which indicates that it is a simple but effective method to improve model robustness.
