论文标题
$ a^{3} d $：寻找强大的神经体系结构和有效的对抗攻击的平台
$A^{3}D$: A Platform of Searching for Robust Neural Architectures and Efficient Adversarial Attacks
论文作者
论文摘要
深度神经网络（DNN）模型的鲁棒性吸引了越来越多的关注，因为在许多应用中迫切需要安全性。开发了许多现有的开源工具或平台，以通过结合大多数对抗性攻击或防御算法来评估DNN模型的鲁棒性。不幸的是，当前平台没有优化DNN模型架构或对抗性攻击的配置的能力，以进一步增强模型的鲁棒性或对抗性攻击的性能。为了减轻这些问题，在本文中，我们首先提出了一个名为“自动对抗攻击和防御”（$ a^{3} d $）的新颖平台，它可以帮助搜索强大的神经网络体系结构和有效的对抗性攻击。在$ a^{3} d $中，我们采用了多种神经体系结构搜索方法，这些方法考虑了不同的稳健性评估指标，包括四种噪声：对抗性噪声，自然噪声，系统噪声和量化指标，从而导致找到强大的体系结构。此外，我们提出了一个用于自动对抗攻击的数学模型，并提供了多种优化算法来搜索有效的对抗攻击。此外，我们将自动对抗攻击和防御结合在一起，形成一个统一的框架。在自动对抗防御中，搜索的有效攻击可以用作新的鲁棒性评估，以进一步增强鲁棒性。在自动对抗攻击中，可以将搜索的强大体系结构用作威胁模型，以帮助寻找更强大的对抗性攻击。关于CIFAR10，CIFAR100和Imagenet数据集的实验证明了所提出的平台的可行性和有效性，该平台还可以为研究人员提供基准和工具包，用于研究人员在评估和改善DNN模型鲁棒性方面应用自动化机器学习。
The robustness of deep neural networks (DNN) models has attracted increasing attention due to the urgent need for security in many applications. Numerous existing open-sourced tools or platforms are developed to evaluate the robustness of DNN models by ensembling the majority of adversarial attack or defense algorithms. Unfortunately, current platforms do not possess the ability to optimize the architectures of DNN models or the configuration of adversarial attacks to further enhance the robustness of models or the performance of adversarial attacks. To alleviate these problems, in this paper, we first propose a novel platform called auto adversarial attack and defense ($A^{3}D$), which can help search for robust neural network architectures and efficient adversarial attacks. In $A^{3}D$, we employ multiple neural architecture search methods, which consider different robustness evaluation metrics, including four types of noises: adversarial noise, natural noise, system noise, and quantified metrics, resulting in finding robust architectures. Besides, we propose a mathematical model for auto adversarial attack, and provide multiple optimization algorithms to search for efficient adversarial attacks. In addition, we combine auto adversarial attack and defense together to form a unified framework. Among auto adversarial defense, the searched efficient attack can be used as the new robustness evaluation to further enhance the robustness. In auto adversarial attack, the searched robust architectures can be utilized as the threat model to help find stronger adversarial attacks. Experiments on CIFAR10, CIFAR100, and ImageNet datasets demonstrate the feasibility and effectiveness of the proposed platform, which can also provide a benchmark and toolkit for researchers in the application of automated machine learning in evaluating and improving the DNN model robustnesses.
