Early Layers Are More Important For Adversarial Robustness
Early Layers Are More Important For Adversarial Robustness
复制标题
DOI：
--
复制
发表时间：
2022
期刊：
影响因子：
--
通讯作者：
Can Bakiskan;Metehan Cekic;Upamanyu Madhow
中科院分区：
文献类型：
--
作者：
Can Bakiskan;Metehan Cekic;Upamanyu Madhow
对抗性训练及其变体已成为对抗机器学习模型中对抗攻击的事实上的标准，我们寻求对对手训练的深度神经网络（DNN）的洞察在网络中的不同层中，我们开发了一种基于部分对手培训。我们发现，虽然受过对抗训练的网络中的所有层都会有助于鲁棒性，但早期的层扮演着更关键的角色。层次的“扰动与信号比率”的统计数据，而对抗性训练则导致黑匣子DNN只能提供鲁棒性的经验保证调查结果表明，在培训和推断以稳健性的培训中寻找建筑原则可能从DNN的早期层开始。
Adversarial training and its variants have become the de facto standard for combatting against adversarial attacks in machine learning models. In this paper, we seek insight into how an adversarially trained deep neural network (DNN) differs from its naturally trained counterpart, focusing on the role of different layers in the network. To this end, we develop a novel method to measure and attribute adversarial effectiveness to each layer, based on partial adversarial training. We find that, while all layers in an adversarially trained network contribute to robustness, earlier layers play a more crucial role. These conclusions are corroborated by a method of tracking the impact of adversarial perturbations as they flow across the network layers, based on the statistics of ”perturbation-to-signal ratios” across layers. While adversarial training results in black box DNNs which can only provide empirical assurances of robustness, our findings imply that the search for architectural principles in training and inference for building in robustness in an interpretable manner could start with the early layers of a DNN.