论文标题
探索针对无监督的域适应的对抗性强大的训练
Exploring Adversarially Robust Training for Unsupervised Domain Adaptation
论文作者
论文摘要
无监督的域适应性（UDA）方法旨在将知识从标记的源域转移到未标记的目标域。在计算机视觉文献中，UDA已被广泛研究。深层网络已被证明容易受到对抗攻击的影响。但是，很少有重点致力于改善深度UDA模型的对抗性鲁棒性，从而引起了对模型可靠性的严重关注。对抗性训练（AT）被认为是最成功的对抗性防御方法。然而，常规的AT需要地面真相标签来生成对抗性示例和火车模型，从而限制了其在未标记的目标域中的有效性。在本文中，我们旨在探索鲁丁模型：如何通过学习UDA的学习域不变特征来增强未标记的数据鲁棒性？为了回答这个问题，我们将系统的研究用于多个在变体中，可能会应用于UDA。此外，我们建议对UDA提出一种新颖的对抗性训练方法，称为Artuda。对多种对抗性攻击和UDA基准的广泛实验表明，Artuda始终提高UDA模型的对抗性鲁棒性。代码可从https://github.com/shaoyuanlo/artuda获得
Unsupervised Domain Adaptation (UDA) methods aim to transfer knowledge from a labeled source domain to an unlabeled target domain. UDA has been extensively studied in the computer vision literature. Deep networks have been shown to be vulnerable to adversarial attacks. However, very little focus is devoted to improving the adversarial robustness of deep UDA models, causing serious concerns about model reliability. Adversarial Training (AT) has been considered to be the most successful adversarial defense approach. Nevertheless, conventional AT requires ground-truth labels to generate adversarial examples and train models, which limits its effectiveness in the unlabeled target domain. In this paper, we aim to explore AT to robustify UDA models: How to enhance the unlabeled data robustness via AT while learning domain-invariant features for UDA? To answer this question, we provide a systematic study into multiple AT variants that can potentially be applied to UDA. Moreover, we propose a novel Adversarially Robust Training method for UDA accordingly, referred to as ARTUDA. Extensive experiments on multiple adversarial attacks and UDA benchmarks show that ARTUDA consistently improves the adversarial robustness of UDA models. Code is available at https://github.com/shaoyuanlo/ARTUDA
