[论文解读] Attacking Adversarial Attacks as A Defense

Boxi Wú, Heng Pan+7 more|arXiv (Cornell University)|Jun 9, 2021

Adversarial Robustness in Machine Learning参考文献 61被引用 13

一句话总结

该论文提出Hedge Defense，一种新颖的防御方法，通过生成同时攻击所有类别有针对性的防御噪声，利用对抗训练模型中真实类别局部Lipschitz常数更小的特性，使被错误分类的对抗样本恢复为正确预测。该方法在强攻击下将CIFAR-10的鲁棒准确率提升最多12.5%，ImageNet的鲁棒准确率提升5.36%。

ABSTRACT

It is well known that adversarial attacks can fool deep neural networks with imperceptible perturbations. Although adversarial training significantly improves model robustness, failure cases of defense still broadly exist. In this work, we find that the adversarial attacks can also be vulnerable to small perturbations. Namely, on adversarially-trained models, perturbing adversarial examples with a small random noise may invalidate their misled predictions. After carefully examining state-of-the-art attacks of various kinds, we find that all these attacks have this deficiency to different extents. Enlightened by this finding, we propose to counter attacks by crafting more effective defensive perturbations. Our defensive perturbations leverage the advantage that adversarial training endows the ground-truth class with smaller local Lipschitzness. By simultaneously attacking all the classes, the misled predictions with larger Lipschitzness can be flipped into correct ones. We verify our defensive perturbation with both empirical experiments and theoretical analyses on a linear model. On CIFAR10, it boosts the state-of-the-art model from 66.16% to 72.66% against the four attacks of AutoAttack, including 71.76% to 83.30% against the Square attack. On ImageNet, the top-1 robust accuracy of FastAT is improved from 33.18% to 38.54% under the 100-step PGD attack.

研究动机与目标

• 解决对抗训练模型中自然准确率与鲁棒准确率之间持续存在的差距。
• 探究对抗攻击本身是否对小输入扰动存在脆弱性。
• 开发一种防御机制，通过利用对抗训练模型的结构特性，超越随机噪声的防御效果。
• 在不修改底层模型的前提下，提升对AutoAttack和Square Attack等强攻击的鲁棒性。

提出的方法

• Hedge Defense生成同时针对所有类别的防御扰动，利用对抗训练模型中真实类别具有更小局部Lipschitz常数的事实。
• 利用损失曲面分析，识别出错误预测具有更陡峭的损失表面，因此对扰动更敏感。
• 该方法并行地对所有类别应用基于梯度的攻击，旨在将模型预测从错误类别推开，重新引导至真实类别。
• 防御扰动针对每个样本进行定制，确保其有效性高于无差别随机噪声。
• 该方法在CIFAR-10和ImageNet上通过实证验证，在线性模型上进行理论分析，以证明其稳定性和鲁棒性。

实验结果

研究问题

• RQ1 当应用于对抗训练模型时，对抗攻击本身是否对小输入扰动存在脆弱性？
• RQ2 能否设计出利用对抗训练模型中真实类别更小局部Lipschitz常数的防御扰动？
• RQ3 与随机噪声或单类别攻击相比，无类别依赖的多类别攻击策略是否能显著提升鲁棒性？
• RQ4 Hedge Defense能否在AutoAttack和Square Attack等强集成攻击下显著提升鲁棒准确率？

主要发现

• 在CIFAR-10上，Hedge Defense将最先进模型在AutoAttack（四种强大攻击的集成）下的鲁棒准确率从66.16%提升至72.66%。
• 在Square攻击（一种领先的黑盒攻击）下，鲁棒准确率从71.76%提升至83.30%。
• 在ImageNet上，Hedge Defense将FastAT模型在100步PGD攻击下的top-1鲁棒准确率从33.18%提升至38.54%。
• 实证结果表明，对抗攻击并非全部具有均匀鲁棒性——如DeepFool和Square攻击在小随机扰动下显著退化，而PGD和C&W则更具韧性。
• 在线性模型上的理论分析证实，真实类别具有更平坦的损失曲面，为方法设计提供了理论依据。
• Hedge Defense能有效抵御EOT和BPDA等严格攻击，表明其不受到梯度掩蔽问题的影响。