论文标题
通过自动构建攻击合奏的可靠鲁棒性评估
Reliable Robustness Evaluation via Automatically Constructed Attack Ensembles
论文作者
论文摘要
将多个攻击结合在一起的攻击集合（AE）提供了一种评估对抗性鲁棒性的可靠方法。实际上，AE通常是由人类专家构造和调整的，但是，这些专家往往是最佳的和耗时的。在这项工作中，我们提出了AutoAe，这是一种自动构建AE的概念上简单的方法。简而言之，Autoae反复将攻击及其迭代步骤添加到合奏中，从而最大程度地提高了每次额外迭代的合奏改进。从理论上讲，我们表明AutoAE的产生在给定防御的最佳因素范围内均超出了AE。然后，我们使用AutoAe构建两个AES，用于$ L _ {\ infty} $和$ L_2 $攻击，并在不加调或适应45个顶级对抗性防御的情况下将它们应用它们。在所有情况下，除一种情况外，我们比现有AE的鲁棒性评估相等或更好（通常是后者），尤其是在29个情况下，我们获得了比最著名的AES更好的鲁棒性评估。 AutoAE的这种性能将自己视为对抗性鲁棒性的可靠评估协议，这进一步表明了自动AE结构的巨大潜力。代码可在\ url {https://github.com/leegerpeng/autoae}中找到。
Attack Ensemble (AE), which combines multiple attacks together, provides a reliable way to evaluate adversarial robustness. In practice, AEs are often constructed and tuned by human experts, which however tends to be sub-optimal and time-consuming. In this work, we present AutoAE, a conceptually simple approach for automatically constructing AEs. In brief, AutoAE repeatedly adds the attack and its iteration steps to the ensemble that maximizes ensemble improvement per additional iteration consumed. We show theoretically that AutoAE yields AEs provably within a constant factor of the optimal for a given defense. We then use AutoAE to construct two AEs for $l_{\infty}$ and $l_2$ attacks, and apply them without any tuning or adaptation to 45 top adversarial defenses on the RobustBench leaderboard. In all except one cases we achieve equal or better (often the latter) robustness evaluation than existing AEs, and notably, in 29 cases we achieve better robustness evaluation than the best known one. Such performance of AutoAE shows itself as a reliable evaluation protocol for adversarial robustness, which further indicates the huge potential of automatic AE construction. Code is available at \url{https://github.com/LeegerPENG/AutoAE}.
