论文标题
对抗性顶点混合：迈向更好的对手稳定性的概括
Adversarial Vertex Mixup: Toward Better Adversarially Robust Generalization
论文作者
论文摘要
对抗性示例导致神经网络以高信心产生不正确的产出。尽管对抗性训练是针对对抗性例子的最有效的防御形式之一，但不幸的是，在对抗性训练中，测试准确性与训练准确性之间存在很大的差距。在本文中，我们确定了对抗性特征过度拟合（AFO），这可能会导致较差的对抗性强大的概括，并且我们表明，对抗训练可以超过强大的概括，从而超过了最佳点，从而在简单的高斯模型中导致AFO。考虑到这些理论结果，我们将软标记作为解决AFO问题的解决方案。此外，我们提出了对抗性顶点混音（AVMIXUP），这是一种软标记的数据增强方法，用于改善对抗性稳定性的概括。我们通过对CIFAR10，CIFAR100，SVHN和Tiny Imagenet的实验进行了补充的理论分析，并表明AVMIXUP显着改善了稳健的概括性能，并降低了标准准确性和对抗性鲁棒性之间的权衡。
Adversarial examples cause neural networks to produce incorrect outputs with high confidence. Although adversarial training is one of the most effective forms of defense against adversarial examples, unfortunately, a large gap exists between test accuracy and training accuracy in adversarial training. In this paper, we identify Adversarial Feature Overfitting (AFO), which may cause poor adversarially robust generalization, and we show that adversarial training can overshoot the optimal point in terms of robust generalization, leading to AFO in our simple Gaussian model. Considering these theoretical results, we present soft labeling as a solution to the AFO problem. Furthermore, we propose Adversarial Vertex mixup (AVmixup), a soft-labeled data augmentation approach for improving adversarially robust generalization. We complement our theoretical analysis with experiments on CIFAR10, CIFAR100, SVHN, and Tiny ImageNet, and show that AVmixup significantly improves the robust generalization performance and that it reduces the trade-off between standard accuracy and adversarial robustness.
