A Direct Approach to Robust Deep Learning Using Adversarial Networks
Huaxia Wang Department of Electrical and Computer Engineering Stevens Institute of Technology Hoboken, NJ 07030, USA、Chun-Nam Yu Nokia Bell Labs 600 Mountain Avenue Murray Hill, NJ 07974, USA
Abstract
Deep neural networks have been shown to perform well in many classical machine learning problems, especially in image classification tasks. However, researchers have found that neural networks can be easily fooled, and they are surprisingly sensitive to small perturbations imperceptible to humans. Carefully crafted input images (adversarial examples) can force a well-trained neural network to provide arbitrary outputs. Including adversarial examples during training is a popular defense mechanism against adversarial attacks. In this paper we propose a new defensive mechanism under the generative adversarial network (GAN) framework. We model the adversarial noise using a generative network, trained jointly with a classification discriminative network as a minimax game. We show empirically that our adversarial network approach works well against black box attacks, with performance on par with state-of-art methods such as ensemble adversarial training and adversarial training with projected gradient descent.
中文速览
神经网络容易被"对抗样本"（adversarial examples）欺骗——只需在图片上叠加人眼察觉不到的微小噪声，就能让模型给出错误分类。为解决这一问题，作者将生成对抗网络（GAN）的博弈思路直接引入防御：用一个生成网络专门负责"制造噪声来骗过分类器"，同时训练分类网络去抵抗这些噪声，两者在对抗中共同优化，而非像传统方法那样事先生成一批固定的对抗样本再做数据增强。实验表明，这种联合训练出的分类网络在抵御黑盒攻击时，与集成对抗训练、PGD对抗训练等当前最优方法旗鼓相当，部分场景下甚至更好。这项工作的意义在于它首次验证了"让攻击网络与防御网络实时共同演化"的可行性，为设计更灵活、更通用的对抗鲁棒模型提供了新思路。
原文 arXiv:1905.09591;中英对照 + 大白话阅读 https://aha.fim.ai/paper/1905.09591v1