[论文解读] Defending Multimodal Fusion Models against Single-Source Adversaries

Karren Yang, Wanyi Lin+3 more|arXiv (Cornell University)|Jun 25, 2022

Adversarial Robustness in Machine Learning被引用 5

一句话总结

本文提出了一种鲁棒融合策略，通过利用多模态一致性进行奇数模态学习，检测并过滤单模态中的对抗性扰动，显著提升了动作识别、目标检测和情感分析任务中单源对抗鲁棒性，且未降低干净数据上的性能表现。

ABSTRACT

Beyond achieving high performance across many vision tasks, multimodal models are expected to be robust to single-source faults due to the availability of redundant information between modalities. In this paper, we investigate the robustness of multimodal neural networks against worst-case (i.e., adversarial) perturbations on a single modality. We first show that standard multimodal fusion models are vulnerable to single-source adversaries: an attack on any single modality can overcome the correct information from multiple unperturbed modalities and cause the model to fail. This surprising vulnerability holds across diverse multimodal tasks and necessitates a solution. Motivated by this finding, we propose an adversarially robust fusion strategy that trains the model to compare information coming from all the input sources, detect inconsistencies in the perturbed modality compared to the other modalities, and only allow information from the unperturbed modalities to pass through. Our approach significantly improves on state-of-the-art methods in single-source robustness, achieving gains of 7.8-25.2% on action recognition, 19.7-48.2% on object detection, and 1.6-6.7% on sentiment analysis, without degrading performance on unperturbed (i.e., clean) data.

研究动机与目标

• 探究标准多模态融合模型在多样化任务中对单源对抗扰动的脆弱性。
• 解决多模态系统中单源对抗鲁棒性缺乏实证研究的问题。
• 开发一种增强鲁棒性但不降低干净数据性能的防御策略。
• 通过避免资源密集型端到端对抗训练，实现在真实多模态系统中的实用鲁棒性。

提出的方法

• 引入一种奇数模态网络，通过跨模态比较特征，识别三组输入中不一致的模态。
• 使用奇数模态学习训练该网络，使模型学会检测哪一模态偏离了其余两个模态。
• 采用鲁棒融合网络，抑制检测到的受扰模态的特征，并仅融合剩余模态的一致特征。
• 使用预训练的模态专用特征提取器生成的非对齐特征作为奇数模态网络的输入，以保留用于检测的上下文信息。
• 采用两阶段训练流程：首先训练奇数模态网络以检测对抗性输入；其次使用检测到的一致特征训练融合网络。
• 仅将对抗训练限制在融合网络和奇数模态网络的参数上，相比完整模型的对抗训练，显著降低了计算成本。

Figure 1: (a) Example of a single source, worst-case ( i.e . , adversarial) perturbation on a multimodal model. (b) Standard multimodal models are vulnerable to worst-case perturbations on any single modality (“Vulnerable”). Our adversarially robust fusion strategy (“Robust”) leverages multimodal co

实验结果

研究问题

• RQ1 即使存在多个未受扰的模态，标准多模态融合模型是否仍对单源对抗扰动敏感？
• RQ2 能否利用多模态一致性来检测并过滤来自单个模态的对抗性输入？
• RQ3 鲁棒融合策略是否能在不降低干净、未受扰数据性能的前提下提升对抗鲁棒性？
• RQ4 奇数模态检测机制在不同模态冗余水平下的性能表现如何？
• RQ5 所提出的方法能否防御具有防御机制访问权限的自适应白盒攻击？

主要发现

• 标准多模态融合模型对单源对抗攻击高度脆弱，即使在存在多个未受扰模态的情况下，其性能仍低于相同攻击下的单模态模型。
• 所提出的奇数模态学习方法在动作识别（EPIC-Kitchens）任务中实现了7.8–25.2%的单源鲁棒性提升。
• 在2D目标检测（KITTI）任务中，该方法实现了19.7–48.2%的鲁棒性增益，表明在高冗余设置下具有强大有效性。
• 在情感分析（CMU-MOSI）任务中，该方法使鲁棒性提升了1.6–6.7%，证明其在多样化任务中的适用性。
• 该方法保持了与标准融合模型相当的干净数据性能，未在未受扰数据上造成显著性能下降。
• 仅需对KITTI数据集中的3.3%模型参数进行微调即可实现鲁棒性提升，与端到端对抗训练相比，显著降低了资源消耗。

Figure 2: We propose a robust multimodal fusion strategy based on “odd-one-out” learning, an auxiliary self-supervised task in which a model is presented with multiple elements and must predict which one of them is different from the others. A multimodal model augmented with an odd-one-out network c