论文标题
通过分类层的重量惩罚来改善对抗性鲁棒性
Improve Adversarial Robustness via Weight Penalization on Classification Layer
论文作者
论文摘要
众所周知，深层神经网络容易受到对抗性攻击的影响。最近的研究表明，精心设计的分类零件可以带来更好的鲁棒性。但是，沿着这条线仍然有很大的改进空间。在本文中，我们首先证明，从几何学的角度来看，神经网络的鲁棒性等同于分类器权重的某些角度边缘条件。然后，我们解释为什么在此框架下，Relu类型功能不是激活的好选择。这些发现揭示了现有方法的局限性，并导致我们开发了一种新颖的轻质含量防御方法，该方法很简单并且具有良好的可扩展性。多个基准数据集的经验结果表明，我们的方法可以有效地改善网络的鲁棒性，而无需过多其他计算，同时保持高分分类的精度。
It is well-known that deep neural networks are vulnerable to adversarial attacks. Recent studies show that well-designed classification parts can lead to better robustness. However, there is still much space for improvement along this line. In this paper, we first prove that, from a geometric point of view, the robustness of a neural network is equivalent to some angular margin condition of the classifier weights. We then explain why ReLU type function is not a good choice for activation under this framework. These findings reveal the limitations of the existing approaches and lead us to develop a novel light-weight-penalized defensive method, which is simple and has a good scalability. Empirical results on multiple benchmark datasets demonstrate that our method can effectively improve the robustness of the network without requiring too much additional computation, while maintaining a high classification precision for clean data.
