基于统一数学化描述的深度学习系统对抗性现象研究

对抗性现象是深度学习系统面临的严重安全威胁之一，即在正常样本上加入人眼难以察觉的恶意噪声，就可明显改变系统的输出。尽管该领域已出现不少对抗攻击和防御方法，但对于对抗性现象的原理依然缺乏深刻认识，因而导致对抗防御方法往往缺乏严格的理论指导，难以真正保证系统的安全。本项目旨在以针对对抗性原理的全面分析为基础，探索构建安全可靠的深度学习系统的有效解决方案。本项目首先提出对抗性现象的统一数学化描述，清晰刻画了深度学习的基本要素，即模型、数据和损失函数，与对抗性现象的关系。该描述为训练和测试阶段的对抗攻击与防御等研究分支提供了统一视角，还可揭示各分支的内在联系。在该描述的指导下，本项目拟从模型结构、数据特征和对抗训练机制三个维度分析对抗性原理，并将探索基于神经网络架构搜索的鲁棒模型结构搜索方法、基于强化学习的鲁棒特征分离策略、和基于对抗样本分布规律对抗棒训练方法，以此构建全面的对抗防御体系。

Adversarial phenomenon is one of the most serious security threats for deep learning systems. It describes that adding an imperceptible malicious noise onto one benign example could easily fool deep learning models. Although many methods of adversarial attacks and defenses have been developed, there is still lack of a deep understanding of the intrinsic reason of adversarial phenomenon. Consequently, current adversarial defenses are often without solid theoretical support, such that the security of deep learning systems cannot be truly guaranteed. The goal of this project is to explore effective methods of constructing secure and trusty deep learning systems, based on a comprehensive analysis of the intrinsic reason of adversarial phenomenon. To this end, we firstly propose a unified mathematical description about adversarial phenomenon, which clearly describes the relationship between adversarial phenomenon and three basic concepts of deep learning systems, including models, data and loss functions. It not only provides a unified perspective for different branches, including adversarial attacks and defenses in both the training and testing stage, but also builds intrinsic connections among these branches. According to this unified description, the project plans to analyze the intrinsic reason of adversarial phenomenon from three perspectives of model architectures, data and adversarial training mechanisms. We also plan to explore the learning method of robust model architectures based on neural architecture search, the separation strategy of robust features based on reinforcement learning, as well as the robust training method utilizing the distribution of adversarial examples, in order to construct comprehensive adversarial defense systems.