论文标题
advms：一种多源的多成本防御对抗攻击
AdvMS: A Multi-source Multi-cost Defense Against Adversarial Attacks
论文作者
论文摘要
设计有效的防御对抗攻击是一个关键主题，因为在许多关键安全域（例如恶意软件检测和自动驾驶汽车）中，深层神经网络已迅速增殖。传统的防御方法虽然证明是有希望的，但在很大程度上受其单一源单成本性质的限制：当防御能力变得越来越强，而成本倾向于放大时，稳健性促进趋于平稳。在本文中，我们研究了设计多源和多成本方案的原理，在这些方案中，从多个防御组件中提高了防御性能。基于这种动机，我们提出了一种多源和多成本的防御方案，即受过对抗训练的模型切换（ADVMS），该方案从两个领先的方案中继承了优势：对抗性训练和随机模型切换。我们表明，Advms的多源性质减轻了性能高原问题，而多成本的性质可以在不同因素的灵活且可调节的成本组合中提高鲁棒性，而不是不同因素，这可以更好地适应实践中的特定限制和需求。
Designing effective defense against adversarial attacks is a crucial topic as deep neural networks have been proliferated rapidly in many security-critical domains such as malware detection and self-driving cars. Conventional defense methods, although shown to be promising, are largely limited by their single-source single-cost nature: The robustness promotion tends to plateau when the defenses are made increasingly stronger while the cost tends to amplify. In this paper, we study principles of designing multi-source and multi-cost schemes where defense performance is boosted from multiple defending components. Based on this motivation, we propose a multi-source and multi-cost defense scheme, Adversarially Trained Model Switching (AdvMS), that inherits advantages from two leading schemes: adversarial training and random model switching. We show that the multi-source nature of AdvMS mitigates the performance plateauing issue and the multi-cost nature enables improving robustness at a flexible and adjustable combination of costs over different factors which can better suit specific restrictions and needs in practice.
