Certified Adversarial Robustness with Additive Noise
Bai Li Department of Statistical Science Duke University、Changyou Chen Department of CSE University at Buffalo, SUNY Wenlin Wang Department of ECE Duke University、Lawrence Carin Department of ECE Duke University
Abstract
The existence of adversarial data examples has drawn significant attention in the deep-learning community; such data are seemingly minimally perturbed relative to the original data, but lead to very different outputs from a deep-learning algorithm. Although a significant body of work on developing defensive models has been considered, most such models are heuristic and are often vulnerable to adaptive attacks. Defensive methods that provide theoretical robustness guarantees have been studied intensively, yet most fail to obtain non-trivial robustness when a large-scale model and data are present. To address these limitations, we introduce a framework that is scalable and provides certified bounds on the norm of the input manipulation for constructing adversarial examples. We establish a connection between robustness against adversarial perturbation and additive random noise, and propose a training strategy that can significantly improve the certified bounds. Our evaluation on MNIST, CIFAR-10 and ImageNet suggests that the proposed method is scalable to complicated models and large data sets, while providing competitive robustness to state-of-the-art provable defense methods.
中文速览
对抗样本（adversarial examples）只需对图像做极细微的改动，就能让深度神经网络给出完全错误的分类，现有的防御方法要么缺乏理论保障，要么虽有证明但难以扩展到大模型和大数据集。这篇论文提出了一个基于 Rényi 散度的理论框架：通过在输入上叠加随机高斯噪声（或拉普拉斯噪声），并利用 Rényi 散度分析自然样本与对抗样本经过噪声后的输出分布差异，从而为分类器的抗扰动能力推导出可证明的上界（certified bound）——只要攻击扰动的范数小于这个上界，分类结果就一定不会被改变。更关键的是，论文揭示了"对对抗扰动的鲁棒性"与"对随机加性噪声的鲁棒性"之间的直接联系，并据此设计了一种稳定性训练策略，通过提升模型在随机噪声下的准确率来显著提高可证明的鲁棒性界。在 MNIST、CIFAR-10 和 ImageNet 上的实验表明，该方法既能扩展到复杂的大规模模型，又在可证明鲁棒性指标上与当前最优方法相当，填补了理论保障与实际可扩展性之间的空缺。
原文 arXiv:1809.03113;中英对照 + 大白话阅读 https://aha.fim.ai/paper/1809.03113v6