我们能拥有这一切吗?关于神经网络的空间和反天体强力之间的权衡。 (Can we have it all? On the Trade-off between Spatial and Adversarial Robustness of Neural Networks)

from arxiv, Accepted NeurIPS 2021. Preliminary version consisting early experimental results was presented in ICML 2018 Workshop on "Towards learning with limited labels: Equivariance, Invariance,and Beyond" as "Understanding Adversarial Robustness of Symmetric Networks"

(Non-)robustness of neural networks to small, adversarial pixel-wise perturbations, and as more recently shown, to even random spatial transformations (e.g., translations, rotations) entreats both theoretical and empirical understanding. Spatial robustness to random translations and rotations is commonly attained via equivariant models (e.g., StdCNNs, GCNNs) and training augmentation, whereas adversarial robustness is typically achieved by adversarial training. In this paper, we prove a quantitative trade-off between spatial and adversarial robustness in a simple statistical setting. We complement this empirically by showing that: (a) as the spatial robustness of equivariant models improves by training augmentation with progressively larger transformations, their adversarial robustness worsens progressively, and (b) as the state-of-the-art robust models are adversarially trained with progressively larger pixel-wise perturbations, their spatial robustness drops progressively. Towards achieving pareto-optimality in this trade-off, we propose a method based on curriculum learning that trains gradually on more difficult perturbations (both spatial and adversarial) to improve spatial and adversarial robustness simultaneously.

翻译：神经网络对小型的、对抗性像素的扰动(非)强势网络对小型的、对抗性像素的扰动,以及最近显示的甚至随机的空间转换(如翻译、旋转)对理论和经验的理解。随机翻译和旋转的空间强度通常是通过等同模型(如StdCNNs、GCNNs)和培训增强实现的,而对抗性强力通常是通过对抗性培训实现的。在本文中,我们证明在一个简单的统计环境中空间强力和对抗性强力之间的量化权衡。我们通过展示以下事实来补充这一经验:(a)随着等异模式的空间稳健性通过培训的增强而提高,随着逐渐扩大的转变,其对抗性强力和旋转通常通过等异模式(如StdCNNs、GCNNs)和培训增强而实现,而敌对性强力通常通过对抗性强势性培训而通过对抗性强势性培训,而对抗性强健性通常通过对抗性强势训练来实现。在简单统计环境中实现接近性强健度之间的平衡。我们提出一种基于空间对抗性和对抗性逐步提高空间对抗性学习空间对抗性的方法。