论文标题
关于对抗性鲁棒性和建筑组成部分的相互作用：补丁，卷积和注意力
On the interplay of adversarial robustness and architecture components: patches, convolution and attention
论文作者
论文摘要
近年来，已经开发了用于图像分类的新型体系结构成分，首先是在变压器中使用的注意力和斑块。尽管先前的工作已经分析了建筑成分的某些方面对对抗性攻击的鲁棒性的影响，尤其是对于视觉变形金刚，但对主要因素的理解仍然是有限的。我们将几个（非）固定分类器与不同的架构进行比较，并研究其特性，包括对抗训练对学习特征的解释性和对看不见威胁模型的鲁棒性的影响。从Resnet到Convnext的消融揭示了关键的架构变化，导致$ 10 \％$更高$ \ ell_ \ ell_ \ infty $ - bobustness。
In recent years novel architecture components for image classification have been developed, starting with attention and patches used in transformers. While prior works have analyzed the influence of some aspects of architecture components on the robustness to adversarial attacks, in particular for vision transformers, the understanding of the main factors is still limited. We compare several (non)-robust classifiers with different architectures and study their properties, including the effect of adversarial training on the interpretability of the learnt features and robustness to unseen threat models. An ablation from ResNet to ConvNeXt reveals key architectural changes leading to almost $10\%$ higher $\ell_\infty$-robustness.
