论文标题
部分可观测时空混沌系统的无模型预测
Demystifying the Adversarial Robustness of Random Transformation Defenses
论文作者
论文摘要
神经网络对攻击的缺乏鲁棒性引起了对安全敏感环境（例如自动驾驶汽车）的担忧。虽然许多对策看起来可能很有希望，但只有少数人承受严格的评估。使用随机变换（RT）的防御措施显示出令人印象深刻的结果，尤其是ImageNet上的Bart（Raff等，2019）。但是，这种防御尚未经过严格评估，使其稳健性的理解不足。它们的随机属性使评估更具挑战性，并使对确定性模型的许多提议的攻击变得不可应用。首先，我们表明BART评估中使用的BPDA攻击（Athalye等，2018a）无效，可能高估了其稳健性。然后，我们尝试通过明智的转换和贝叶斯优化来调整其参数来构建最强大的RT防御。此外，我们创造了最强大的攻击来评估我们的RT防御。我们的新攻击极高地表现出了基线，而与常用的EOT攻击降低了19％（$ 4.3 \ times $改善）相比，精度降低了83％。我们的结果表明，在Imagenette数据集上的RT防御（ImageNet的十级子集）在对抗性示例上并不强大。进一步扩展研究，我们使用新的攻击来对抗RT防御（称为Advrt），从而获得了巨大的稳健性增长。代码可从https://github.com/wagner-group/demystify-random-transform获得。
Neural networks' lack of robustness against attacks raises concerns in security-sensitive settings such as autonomous vehicles. While many countermeasures may look promising, only a few withstand rigorous evaluation. Defenses using random transformations (RT) have shown impressive results, particularly BaRT (Raff et al., 2019) on ImageNet. However, this type of defense has not been rigorously evaluated, leaving its robustness properties poorly understood. Their stochastic properties make evaluation more challenging and render many proposed attacks on deterministic models inapplicable. First, we show that the BPDA attack (Athalye et al., 2018a) used in BaRT's evaluation is ineffective and likely overestimates its robustness. We then attempt to construct the strongest possible RT defense through the informed selection of transformations and Bayesian optimization for tuning their parameters. Furthermore, we create the strongest possible attack to evaluate our RT defense. Our new attack vastly outperforms the baseline, reducing the accuracy by 83% compared to the 19% reduction by the commonly used EoT attack ($4.3\times$ improvement). Our result indicates that the RT defense on the Imagenette dataset (a ten-class subset of ImageNet) is not robust against adversarial examples. Extending the study further, we use our new attack to adversarially train RT defense (called AdvRT), resulting in a large robustness gain. Code is available at https://github.com/wagner-group/demystify-random-transform.
