论文标题
随机化事项。如何防御强烈的对抗攻击
Randomization matters. How to defend against strong adversarial attacks
论文作者
论文摘要
是否有分类器确保对所有对抗性攻击的最佳鲁棒性？本文通过采用游戏理论的观点来回答这个问题。我们表明，对抗性攻击和防御构成了无限的零和游戏，其中经典结果（例如sion定理）不适用。当分类器和对手都是确定性的，因此在确定性制度中给上述问题给出了负面答案，我们在游戏中表明了NASH平衡的不存在。尽管如此，这个问题仍然在随机制度中开放。我们通过表明数据集分布上的宇宙条件来解决此问题，任何确定性分类器都可以由随机分布符胜过。这给出了使用随机化的参数，并导致我们采用一种新算法，用于构建对强烈的对抗性攻击的随机分类器。经验结果验证了我们的理论分析，并表明我们的防御方法大大优于针对最新攻击的对抗性训练。
Is there a classifier that ensures optimal robustness against all adversarial attacks? This paper answers this question by adopting a game-theoretic point of view. We show that adversarial attacks and defenses form an infinite zero-sum game where classical results (e.g. Sion theorem) do not apply. We demonstrate the non-existence of a Nash equilibrium in our game when the classifier and the Adversary are both deterministic, hence giving a negative answer to the above question in the deterministic regime. Nonetheless, the question remains open in the randomized regime. We tackle this problem by showing that, undermild conditions on the dataset distribution, any deterministic classifier can be outperformed by a randomized one. This gives arguments for using randomization, and leads us to a new algorithm for building randomized classifiers that are robust to strong adversarial attacks. Empirical results validate our theoretical analysis, and show that our defense method considerably outperforms Adversarial Training against state-of-the-art attacks.
