Deep neural networks have been found vulnerable to adversarial attacks, thus raising potentially concerns in security-sensitive contexts. To address this problem, recent research has investigated the adversarial robustness of deep neural networks from the architectural point of view. However, searching for architectures of deep neural networks is computationally expensive, particularly when coupled with adversarial training process. To meet the above challenge, this paper proposes a bi-fidelity multiobjective neural architecture search approach. First, we formulate the NAS problem for enhancing adversarial robustness of deep neural networks into a multiobjective optimization problem. Specifically, in addition to a low-fidelity performance predictor as the first objective, we leverage an auxiliary-objective -- the value of which is the output of a surrogate model trained with high-fidelity evaluations. Secondly, we reduce the computational cost by combining three performance estimation methods, i.e., parameter sharing, low-fidelity evaluation, and surrogate-based predictor. The effectiveness of the proposed approach is confirmed by extensive experiments conducted on CIFAR-10, CIFAR-100 and SVHN datasets.
翻译:为解决这一问题,最近的研究从建筑角度对深神经网络的对抗性强力进行了调查。然而,寻找深神经网络的建筑在计算上是昂贵的,特别是当与对抗性培训过程相结合时。为了应对上述挑战,本文件建议采用双纤维多目标神经结构搜索方法。首先,我们将NAS问题设计成一个多目标优化问题,以加强深神经网络的对抗性强力。具体地说,除了低纤维性能预测器作为第一个目标外,我们还利用一个辅助目标 -- -- 其价值是经过高纤维性能评估培训的代用模型的产出。第二,我们通过结合三种性能估计方法,即参数共享、低纤维性能评估和以子宫为基础的预测器,降低计算成本。对CIFAR-10、CIFAR-100和SVHN数据集进行的广泛实验证实了拟议方法的有效性。