论文标题
了解卷积层特征图的对抗性鲁棒性
Understanding Adversarial Robustness from Feature Maps of Convolutional Layers
论文作者
论文摘要
神经网络的对抗性鲁棒性主要取决于两个因素：模型容量和反扰动能力。在本文中，我们研究了网络从卷积层的特征图中的抗扰动能力。我们的理论分析发现，在平均合并之前，较大的卷积特征图可以有助于更好地抵抗扰动，但是对于最大池而言，结论并非如此。它为强大的神经网络设计带来了新的灵感，并敦促我们应用这些发现以改善现有建筑。所提出的修改非常简单，只需要对输入采样或稍微修改下采样操作员的步幅配置。我们在几个基准神经网络架构上验证了我们的方法，包括Alexnet，VGG，Restnet18和Preactresnet18。在各种攻击和防御机制下，都可以实现自然准确性和对抗性鲁棒性方面的非平凡改进。该代码可在\ url {https://github.com/mtandhj/rcm}中获得。
The adversarial robustness of a neural network mainly relies on two factors: model capacity and anti-perturbation ability. In this paper, we study the anti-perturbation ability of the network from the feature maps of convolutional layers. Our theoretical analysis discovers that larger convolutional feature maps before average pooling can contribute to better resistance to perturbations, but the conclusion is not true for max pooling. It brings new inspiration to the design of robust neural networks and urges us to apply these findings to improve existing architectures. The proposed modifications are very simple and only require upsampling the inputs or slightly modifying the stride configurations of downsampling operators. We verify our approaches on several benchmark neural network architectures, including AlexNet, VGG, RestNet18, and PreActResNet18. Non-trivial improvements in terms of both natural accuracy and adversarial robustness can be achieved under various attack and defense mechanisms. The code is available at \url{https://github.com/MTandHJ/rcm}.
