Learning with a Strong Adversary
Ruitong Huang, Bing Xu, Dale Schuurmans and Csaba Szepesvári Department of Computer Science University of Alberta Edmonton, AB T6G 2E8, Canada
Abstract
The robustness of neural networks to intended perturbations has recently attracted significant attention. In this paper, we propose a new method, learning with a strong adversary, that learns robust classifiers from supervised data by generating adversarial examples as an intermediate step. A new and simple way of finding adversarial examples is presented that is empirically stronger than existing approaches in terms of the accuracy reduction as a function of perturbation magnitude. Experimental results demonstrate that resulting learning method greatly improves the robustness of the classification models produced.
中文速览
深度神经网络（DNN）虽然在图像、语音分类上表现出色，却极易被人眼几乎无法察觉的微小扰动欺骗，导致分类错误——这类精心构造的输入被称为对抗样本（adversarial examples）。针对这一脆弱性，作者提出了一种"强对手训练（learning with a strong adversary）"方法，将训练过程建模为最小-最大（min-max）优化问题：内层的"对手"在有界扰动范围内最大化分类损失，外层的学习器则针对这些最坏情况扰动最小化误分类率；同时，作者还提出了一种基于雅可比矩阵线性近似的新对抗样本生成算法，实验表明它比已有方法能在更小扰动幅度下造成更大的精度下降，即"更强"。在MNIST和CIFAR-10上的实验结果表明，采用该方法训练的模型在面对对抗扰动时显著优于此前的对抗训练方案，同时保持了较高的正常分类精度。这项工作从优化原理出发为鲁棒分类器的训练提供了理论支撑，对提升深度学习系统在安全敏感场景下的可靠性具有重要意义。
原文 arXiv:1511.03034;中英对照 + 大白话阅读 https://aha.fim.ai/paper/1511.03034v6