论文标题
关于普遍化的对抗和不变的扰动
On Universalized Adversarial and Invariant Perturbations
论文作者
论文摘要
卷积神经网络或标准CNN（STDCNN）是翻译等值的模型，在接受足够翻译的数据进行培训时，可以实现翻译不变性。对于给定的一组转换组（例如，旋转）的近似模型的最新工作已导致群 - 等级卷积神经网络（GCNNS）。接受足够旋转的数据训练的GCNN实现了旋转不变性。作者Arxiv的最新工作：2002.11318研究了对对抗攻击的不变性和稳健性之间的权衡。在另一项相关的工作中，Arxiv：2005.08632，给定任何模型和满足某些光谱特性的任何输入依赖性攻击，作者提出了一种称为SVD-宇宙的普遍化技术，可以通过查看很少的测试示例来产生普遍的对抗性扰动。在本文中，我们研究了SVD - 宇宙对GCNNS的有效性，因为它们通过更高的训练增强获得了旋转不变性。我们从经验上观察到，随着GCNNS通过较大的旋转增强训练而获得旋转不变性，SVD - 宇宙的愚蠢率变得更好。为了理解这一现象，我们介绍了普遍的不变方向，并研究了它们与SVD宇宙产生的普遍对抗方向的关系。
Convolutional neural networks or standard CNNs (StdCNNs) are translation-equivariant models that achieve translation invariance when trained on data augmented with sufficient translations. Recent work on equivariant models for a given group of transformations (e.g., rotations) has lead to group-equivariant convolutional neural networks (GCNNs). GCNNs trained on data augmented with sufficient rotations achieve rotation invariance. Recent work by authors arXiv:2002.11318 studies a trade-off between invariance and robustness to adversarial attacks. In another related work arXiv:2005.08632, given any model and any input-dependent attack that satisfies a certain spectral property, the authors propose a universalization technique called SVD-Universal to produce a universal adversarial perturbation by looking at very few test examples. In this paper, we study the effectiveness of SVD-Universal on GCNNs as they gain rotation invariance through higher degree of training augmentation. We empirically observe that as GCNNs gain rotation invariance through training augmented with larger rotations, the fooling rate of SVD-Universal gets better. To understand this phenomenon, we introduce universal invariant directions and study their relation to the universal adversarial direction produced by SVD-Universal.
