论文标题
展开（几乎）完美对抗检测的局部增长率估计值
Unfolding Local Growth Rate Estimates for (Almost) Perfect Adversarial Detection
论文作者
论文摘要
卷积神经网络（CNN）在许多感知任务上定义了最先进的解决方案。但是，当前的CNN方法在很大程度上仍然很容易受到对对抗性的对抗性扰动的影响，这些扰动是专门为欺骗系统而被人眼侵蚀的系统而设计的。近年来，已经提出了各种方法来捍卫CNN免受此类攻击，例如通过模型硬化或增加明确的防御机制。因此，网络中包含一个小的“检测器”，并根据二进制分类任务进行培训，该任务将真实数据与包含对抗性扰动的数据区分开。在这项工作中，我们提出了一个简单且轻巧的检测器，该检测器利用了有关网络局部内在维度（LID）和对抗性攻击之间关系的最新发现。基于对盖子度量的重新解释和几种简单的改编，我们通过显着的边距超过了对抗检测的最新，并且在几个网络和数据集的F1得分方面达到了几乎完美的结果。来源可用：https：//github.com/adverml/multilid
Convolutional neural networks (CNN) define the state-of-the-art solution on many perceptual tasks. However, current CNN approaches largely remain vulnerable against adversarial perturbations of the input that have been crafted specifically to fool the system while being quasi-imperceptible to the human eye. In recent years, various approaches have been proposed to defend CNNs against such attacks, for example by model hardening or by adding explicit defence mechanisms. Thereby, a small "detector" is included in the network and trained on the binary classification task of distinguishing genuine data from data containing adversarial perturbations. In this work, we propose a simple and light-weight detector, which leverages recent findings on the relation between networks' local intrinsic dimensionality (LID) and adversarial attacks. Based on a re-interpretation of the LID measure and several simple adaptations, we surpass the state-of-the-art on adversarial detection by a significant margin and reach almost perfect results in terms of F1-score for several networks and datasets. Sources available at: https://github.com/adverML/multiLID
