论文标题
通过将更多的正规化放在较少鲁棒的样本上，改善对抗性鲁棒性
Improving Adversarial Robustness by Putting More Regularizations on Less Robust Samples
论文作者
论文摘要
对抗性训练是为了增强针对对抗性攻击的鲁棒性，它引起了很多关注，因为很容易产生人类侵蚀性数据的扰动，以欺骗给定的深层神经网络。在本文中，我们提出了一种新的对抗性培训算法，该算法在理论上具有良好的动机，并且在经验上优于其他现有算法。该算法的一个新功能是将比其他正则化算法更容易受到对抗性攻击的数据应用。从理论上讲，我们表明我们的算法可以理解为最大程度地减少从鲁棒风险的新派生的上界动机的正规经验风险的算法。数值实验表明，我们提出的算法同时提高了概括（示例准确性）和鲁棒性（对对抗攻击的准确性），以实现最新的性能。
Adversarial training, which is to enhance robustness against adversarial attacks, has received much attention because it is easy to generate human-imperceptible perturbations of data to deceive a given deep neural network. In this paper, we propose a new adversarial training algorithm that is theoretically well motivated and empirically superior to other existing algorithms. A novel feature of the proposed algorithm is to apply more regularization to data vulnerable to adversarial attacks than other existing regularization algorithms do. Theoretically, we show that our algorithm can be understood as an algorithm of minimizing the regularized empirical risk motivated from a newly derived upper bound of the robust risk. Numerical experiments illustrate that our proposed algorithm improves the generalization (accuracy on examples) and robustness (accuracy on adversarial attacks) simultaneously to achieve the state-of-the-art performance.
