Deep neural networks have been demonstrated to be vulnerable to adversarial noise, promoting the development of defense against adversarial attacks. Motivated by the fact that adversarial noise contains well-generalizing features and that the relationship between adversarial data and natural data can help infer natural data and make reliable predictions, in this paper, we study to model adversarial noise by learning the transition relationship between adversarial labels (i.e. the flipped labels used to generate adversarial data) and natural labels (i.e. the ground truth labels of the natural data). Specifically, we introduce an instance-dependent transition matrix to relate adversarial labels and natural labels, which can be seamlessly embedded with the target model (enabling us to model stronger adaptive adversarial noise). Empirical evaluations demonstrate that our method could effectively improve adversarial accuracy.
翻译:事实证明,深神经网络很容易受到对抗性噪音的影响,有利于防御对抗性攻击的防御发展,其动机是,对抗性噪音含有广泛的特征,敌对性数据与自然数据之间的关系有助于推断自然数据并作出可靠的预测,在本文件中,我们研究如何通过学习对抗性标签(即用于产生对抗性数据的翻转标签)与自然标签(即自然数据地面真相标签)之间的过渡关系来模拟对抗性噪音。 具体地说,我们采用了一个以实例为依据的过渡矩阵,将对抗性标签和自然标签联系起来,这些标签和自然标签可以与目标模型无缝地嵌入(使我们能够模拟更强的适应性对抗性对抗性噪音 ) 。 经验性评估表明,我们的方法可以有效地提高对抗性标签的准确性。