数据与模型安全 课件 第5周：对抗防御.pptx

AdversarialDefense姜育刚，马兴军，吴祖煊

Recap:week41.AdversarialExampleDetectionSecondaryClassificationMethods(二级分类法)PrincipleComponentAnalysis(主成分分析法，PCA)DistributionDetectionMethods(分布检测法)PredictionInconsistency(预测不一致性)ReconstructionInconsistency(重建不一致性)TrappingBasedDetection(诱捕检测法)

AdversarialAttackCompetitionLink:https://codalab.lisn.upsaclay.fr/competitions/15669?secret_key=77cb8986-d5bd-4009-82f0-7dde2e819ff8

AdversarialDefensevsDetectionTheweirdrelationshipbetweendefenseanddetectionDetectionISdefenseBut…whenwesaydefense,we(mostofthetime)meanthemodelissecured,yetdetectioncannotdothat…Insurveypapers:detectionisdefenseIntechnicalpapers:defenseisdefensenotdetectionDifferencesDefenseistosecurethemodelorthesystemDetectionistoidentifypotentialthreats,whichshouldbefollowedbyadefensestrategy,e.g.,queryrejection(butmostlyignored)Bydefense,itmostlymeansrobusttrainingmethods

DefenseMethodsEarlyDefenseMethodsEarlyAdversarialTrainingMethodsLaterAdversarialTrainingMethodsRemainingChallengesandRecentProgress

ARecapoftheTimeline2014年Goodfellow等人提出快速单步攻击FGSM及对抗训练2015年简单检测方法（PCA）和对抗训练方法2016年提出对抗训练的min-max优化框架2017年大量的对抗样本检测方法和攻击方法（BIM、CW）、10种检测方法被攻破2019年TRADES及大量其他对抗训练方法、第一篇Science文章2018年物理世界攻击方法、检测方法升级、PGD攻击与对抗训练、9种防御方法被攻破2020年AutoAttack攻击、Fast对抗训练2021年增大模型、增加数据的对抗训练、领域延伸2022年尚未解决的问题，攻击越来越多，防御越来越难2013年Biggio等人与Szegedy等人发现对抗样本

PrinciplesofDefenseBlocktheattack(掐头去尾)MasktheinputgradientsRegularizetheinputgradientsDistillthelogitsDenoisetheinputRobustifythemodel(增强中间)SmooththedecisionboundaryReducetheLipschitznessofthemodelSmooththelosslandscape

AdversarialAttackSzegedyC,ZarembaW,SutskeverI,etal.Intriguingpropertiesofneuralnetworks[J].ICLR2014.GoodfellowIJ,ShlensJ,SzegedyC.Explainingandharnessingadversarialexamples[J].ICLR2015.??模型训练:对抗攻击:分类错误扰动很小测试阶段攻击?

PerformanceMetrics??Othermetrics:maximumperturbationfo