论文标题
基于投票的合奏改善了防御模型的鲁棒性
Voting based ensemble improves robustness of defensive models
论文作者
论文摘要
开发针对对抗性扰动的强大模型一直是研究的积极领域，并且已经提出了许多算法来训练单个强大的模型。采用这些预处理的健壮模型，我们旨在研究是否有可能创建一个合奏以进一步提高鲁棒性。以前的几项尝试通过结合软标签预测来解决此问题，并根据最新的攻击方法被证明是脆弱的。在本文中，我们表明，如果强大的训练损失足够多样化，那么简单的基于硬标签的投票集合可以增加每个单独模型的强大错误。此外，在有一个强大的模型的情况下，我们开发了一种原则性的方式来选择要组合的模型。最后，为了验证改善的鲁棒性，我们进行了广泛的实验，以研究如何攻击基于投票的合奏并开发几种新的白色盒子攻击。在CIFAR-10数据集上，通过结合几种最先进的预训练的防御模型，我们的方法可以实现59.8％的鲁棒精度，在不使用其他数据的情况下优于所有现有的防御模型。
Developing robust models against adversarial perturbations has been an active area of research and many algorithms have been proposed to train individual robust models. Taking these pretrained robust models, we aim to study whether it is possible to create an ensemble to further improve robustness. Several previous attempts tackled this problem by ensembling the soft-label prediction and have been proved vulnerable based on the latest attack methods. In this paper, we show that if the robust training loss is diverse enough, a simple hard-label based voting ensemble can boost the robust error over each individual model. Furthermore, given a pool of robust models, we develop a principled way to select which models to ensemble. Finally, to verify the improved robustness, we conduct extensive experiments to study how to attack a voting-based ensemble and develop several new white-box attacks. On CIFAR-10 dataset, by ensembling several state-of-the-art pre-trained defense models, our method can achieve a 59.8% robust accuracy, outperforming all the existing defensive models without using additional data.
