Playing the Game of Universal Adversarial Perturbations
Julien Pérolat DeepMind、Mateusz Malinowski DeepMind、Bilal Piot DeepMind、Olivier Pietquin Google Brain
Abstract
We study the problem of learning classifiers robust to universal adversarial perturbations. While prior work approaches this problem via robust optimization, adversarial training, or input transformation, we instead phrase it as a two-player zero-sum game. In this new formulation, both players simultaneously play the same game, where one player chooses a classifier that minimizes a classification loss whilst the other player creates an adversarial perturbation that increases the same loss when applied to every sample in the training set. By observing that performing a classification (respectively creating adversarial samples) is the best response to the other player, we propose a novel extension of a game-theoretic algorithm, namely fictitious play, to the domain of training robust classifiers. Finally, we empirically show the robustness and versatility of our approach in two defence scenarios where universal attacks are performed on several image classification datasets – CIFAR10, CIFAR100 and ImageNet.
中文速览
针对深度神经网络容易被"通用对抗扰动"（universal adversarial perturbations）欺骗这一安全隐患，研究者将训练鲁棒分类器的问题重新建模为一个双人零和博弈：分类器玩家努力最小化分类损失，而"骗子"玩家同时生成一个能让所有样本都被误判的通用扰动来最大化该损失。受博弈论中虚构博弈（fictitious play）算法的启发，作者提出让两个玩家交替对对方的历史策略做出最优响应，并引入近似方法解决了存储所有历史分类器的内存瓶颈。在 CIFAR-10、CIFAR-100 和 ImageNet 上的实验表明，该方法在抵御通用扰动和对抗补丁（adversarial patch）两类攻击时，比标准对抗训练以更小的准确率代价获得了更强的鲁棒性，且是首个专门针对对抗补丁攻击的防御方案，具有重要的实际安全价值。
原文 arXiv:1809.07802;中英对照 + 大白话阅读 https://aha.fim.ai/paper/1809.07802v2