论文标题
重新思考分类器和对抗性攻击
Rethinking Classifier and Adversarial Attack
论文作者
论文摘要
已经提出了各种防御模型来抵抗对抗性攻击算法，但是现有的对抗性鲁棒性评估方法始终高估了这些模型的对抗性鲁棒性（即，不接近鲁棒性的下限）。为了解决这个问题，本文使用提出的脱致空间方法将分类器分为两个部分：非线性和线性。然后，本文定义了原始示例的表示向量（及其空间，即表示空间），并使用绝对分类边界初始化（ACBI）的迭代优化来获得更好的攻击起点。特别是，本文将ACBI应用于近50种广泛使用的防御模型（包括8个架构）。实验结果表明，ACBI在所有情况下均达到较低的鲁棒精度。
Various defense models have been proposed to resist adversarial attack algorithms, but existing adversarial robustness evaluation methods always overestimate the adversarial robustness of these models (i.e., not approaching the lower bound of robustness). To solve this problem, this paper uses the proposed decouple space method to divide the classifier into two parts: non-linear and linear. Then, this paper defines the representation vector of the original example (and its space, i.e., the representation space) and uses the iterative optimization of Absolute Classification Boundaries Initialization (ACBI) to obtain a better attack starting point. Particularly, this paper applies ACBI to nearly 50 widely-used defense models (including 8 architectures). Experimental results show that ACBI achieves lower robust accuracy in all cases.
