论文标题
鲁棒性来自哪里？对基于转型的合奏防御的研究
Where Does the Robustness Come from? A Study of the Transformation-based Ensemble Defence
论文作者
论文摘要
本文旨在对基于转换的集合防御的有效性进行全面研究，以实现图像分类及其原因。从经验上讲，它们可以增强抵抗逃避攻击的鲁棒性，而对原因的分析很少。特别是，尚不清楚鲁棒性改善是转化还是合奏的结果。在本文中，我们设计了两次自适应攻击，以更好地评估基于转换的整体防御。我们进行实验以表明1）在不同可逆转换后，在数据记录训练的模型中存在对抗示例的可传递性； 2）通过基于转换的合奏获得的鲁棒性是有限的； 3）这种有限的鲁棒性主要来自不可逆的变换，而不是许多模型的集合； 4）盲目增加基于转换的集合中的子模型的数量不会带来额外的鲁棒性增益。
This paper aims to provide a thorough study on the effectiveness of the transformation-based ensemble defence for image classification and its reasons. It has been empirically shown that they can enhance the robustness against evasion attacks, while there is little analysis on the reasons. In particular, it is not clear whether the robustness improvement is a result of transformation or ensemble. In this paper, we design two adaptive attacks to better evaluate the transformation-based ensemble defence. We conduct experiments to show that 1) the transferability of adversarial examples exists among the models trained on data records after different reversible transformations; 2) the robustness gained through transformation-based ensemble is limited; 3) this limited robustness is mainly from the irreversible transformations rather than the ensemble of a number of models; and 4) blindly increasing the number of sub-models in a transformation-based ensemble does not bring extra robustness gain.
