论文标题
通过平滑损失格局来攻击对抗防御
Attacking Adversarial Defences by Smoothing the Loss Landscape
论文作者
论文摘要
本文调查了一种捍卫对抗性攻击的方法家族，其成功的部分原因是创造了嘈杂，不连续或以其他方式坚固的损失景观，而对手发现很难导航。实现这种效果的一种常见但不是普遍的方法是使用随机神经网络。我们表明，这是梯度混淆的一种形式，并基于WeierStrass变换提出了基于梯度的对手的一般扩展，该变换平滑了损耗函数的表面并提供了更可靠的梯度估计。我们进一步表明，相同的原则可以加强无梯度的对手。我们证明了消失方法对由于这种混淆而表现出鲁棒性的随机和非传统对抗防御的功效。此外，我们提供了它如何与对转型的期望相互作用的分析；一种流行的梯度采样方法目前用于攻击随机防御。
This paper investigates a family of methods for defending against adversarial attacks that owe part of their success to creating a noisy, discontinuous, or otherwise rugged loss landscape that adversaries find difficult to navigate. A common, but not universal, way to achieve this effect is via the use of stochastic neural networks. We show that this is a form of gradient obfuscation, and propose a general extension to gradient-based adversaries based on the Weierstrass transform, which smooths the surface of the loss function and provides more reliable gradient estimates. We further show that the same principle can strengthen gradient-free adversaries. We demonstrate the efficacy of our loss-smoothing method against both stochastic and non-stochastic adversarial defences that exhibit robustness due to this type of obfuscation. Furthermore, we provide analysis of how it interacts with Expectation over Transformation; a popular gradient-sampling method currently used to attack stochastic defences.
