论文标题
强大的深度学习合奏反对欺骗
Robust Deep Learning Ensemble against Deception
论文作者
论文摘要
已知深度神经网络（DNN）模型容易受到恶性制作的对抗性例子的影响，并且要远离训练数据的分数输入。如何保护机器学习模型免受两种破坏性输入的欺骗仍然是一个开放的挑战。本文介绍了Xensemble，这是一种多样性集合验证方法，用于增强DNN模型的对抗性鲁棒性，以应对由对抗性示例或分布外输入引起的欺骗。 Xensemble by Design具有三个独特的功能。首先，Xensemble通过利用不同的数据清洁技术来构建多样的输入降级验证符。其次，Xensemble开发了一种分歧多样性集合学习方法，用于保护预测模型的输出免受欺骗。第三，Xensemble提供了一组算法，以结合输入验证和输出验证，以保护DNN预测模型免受对抗性示例和分布输入。我们使用11项流行的对抗性攻击和两个代表性分发数据集进行了评估，我们表明，Xensemble在对抗性示例中取得了很高的防御成功率，并且针对过分分配数据输入的高检测成功率，并且超过了现有的代表性防御方法，对可靠性和防御性。
Deep neural network (DNN) models are known to be vulnerable to maliciously crafted adversarial examples and to out-of-distribution inputs drawn sufficiently far away from the training data. How to protect a machine learning model against deception of both types of destructive inputs remains an open challenge. This paper presents XEnsemble, a diversity ensemble verification methodology for enhancing the adversarial robustness of DNN models against deception caused by either adversarial examples or out-of-distribution inputs. XEnsemble by design has three unique capabilities. First, XEnsemble builds diverse input denoising verifiers by leveraging different data cleaning techniques. Second, XEnsemble develops a disagreement-diversity ensemble learning methodology for guarding the output of the prediction model against deception. Third, XEnsemble provides a suite of algorithms to combine input verification and output verification to protect the DNN prediction models from both adversarial examples and out of distribution inputs. Evaluated using eleven popular adversarial attacks and two representative out-of-distribution datasets, we show that XEnsemble achieves a high defense success rate against adversarial examples and a high detection success rate against out-of-distribution data inputs, and outperforms existing representative defense methods with respect to robustness and defensibility.
