论文标题
使用Voronoi-Epsilon对手测量对抗性鲁棒性
Measuring Adversarial Robustness using a Voronoi-Epsilon Adversary
论文作者
论文摘要
先前关于鲁棒性的研究表明，准确性和对抗性准确性之间存在权衡。即使我们忽略概括，折衷也是不可避免的。我们认为，权衡是对对抗精度的常用定义的固有的，该定义使用了可以构建受数据点$ε$ - ball限制的对抗点的对手。随着$ε$变大，对手可能会将其他类中的实际数据点作为对手示例。我们提出了一个Voronoi-epsilon对手，该对手既受Voronoi细胞和$ε$ - Balls的约束。这种对手在两个扰动概念之间平衡。结果，基于此对手的对抗精度避免了训练数据的准确性和对抗性准确性之间的权衡，即使$ε$很大。最后，我们证明最近的邻居分类器是针对训练数据所提出的对手的最大鲁棒分类器。
Previous studies on robustness have argued that there is a tradeoff between accuracy and adversarial accuracy. The tradeoff can be inevitable even when we neglect generalization. We argue that the tradeoff is inherent to the commonly used definition of adversarial accuracy, which uses an adversary that can construct adversarial points constrained by $ε$-balls around data points. As $ε$ gets large, the adversary may use real data points from other classes as adversarial examples. We propose a Voronoi-epsilon adversary which is constrained both by Voronoi cells and by $ε$-balls. This adversary balances between two notions of perturbation. As a result, adversarial accuracy based on this adversary avoids a tradeoff between accuracy and adversarial accuracy on training data even when $ε$ is large. Finally, we show that a nearest neighbor classifier is the maximally robust classifier against the proposed adversary on the training data.
