论文标题
因果信息瓶颈增强了深神经网络的对抗性鲁棒性
Causal Information Bottleneck Boosts Adversarial Robustness of Deep Neural Network
论文作者
论文摘要
信息瓶颈（IB）方法是针对深度学习中对抗攻击的可行防御解决方案。但是，这种方法遭受了虚假的相关性，这导致了其进一步改善对抗性鲁棒性的局限性。在本文中，我们将因果推论纳入IB框架中，以减轻此类问题。具体而言，我们将通过IB方法获得的功能分为强大的功能（内容信息）和非舒适特征（样式信息）通过仪器变量估算因果效应。随着这种框架的利用，可以减轻非运动特征的影响以增强对抗性的鲁棒性。我们对提出方法的有效性进行分析。 MNIST，FashionMnist和CIFAR-10进行的广泛实验表明，我们的方法对多次对抗攻击具有相当大的鲁棒性。我们的代码将发布。
The information bottleneck (IB) method is a feasible defense solution against adversarial attacks in deep learning. However, this method suffers from the spurious correlation, which leads to the limitation of its further improvement of adversarial robustness. In this paper, we incorporate the causal inference into the IB framework to alleviate such a problem. Specifically, we divide the features obtained by the IB method into robust features (content information) and non-robust features (style information) via the instrumental variables to estimate the causal effects. With the utilization of such a framework, the influence of non-robust features could be mitigated to strengthen the adversarial robustness. We make an analysis of the effectiveness of our proposed method. The extensive experiments in MNIST, FashionMNIST, and CIFAR-10 show that our method exhibits the considerable robustness against multiple adversarial attacks. Our code would be released.
