一句话：提出 A2D 框架，利用攻击代价评估样本鲁棒性，从而检测对抗样本。
深度学习教育软件易受对抗攻击，现有防御机制对自适应攻击往往失效。该工作观察到对抗样本的鲁棒性显著低于良性样本，但传统鲁棒性度量难以扩展到大网络。为此，作者提出“攻击即防御”框架 A2D，通过有效评估输入样本被攻击的代价来刻画其鲁棒性，并将更易被攻击、鲁棒性更低的样本识别为对抗样本。在 MNIST、CIFAR10 和 ImageNet 上的实验表明，A2D 比近期代表性方法更有效；面对精心设计的自适应攻击时也表现良好，例如在 CIFAR10 上攻击成功率降至 0%。
As a new programming paradigm, deep learning has expanded its application to many real-world problems. At the same time, deep learning based software are found to be vulnerable to adversarial attacks. Though various defense mechanisms have been proposed to improve robustness of deep learning software, many of them are ineffective against adaptive attacks. In this work, we propose a novel characterization to distinguish adversarial examples from benign ones based on the observation that adversarial examples are significantly less robust than benign ones. As existing robustness measurement does not scale to large networks, we propose a novel defense framework, named attack as defense (A2D), to detect adversarial examples by effectively evaluating an example’s robustness. A2D uses the cost of attacking an input for robustness evaluation and identifies those less robust examples as adversarial since less robust examples are easier to attack. Extensive experiment results on MNIST, CIFAR10 and ImageNet show that A2D is more effective than recent promising approaches. We also evaluate our defense against potential adaptive attacks and show that A2D is effective in defending carefully designed adaptive attacks, e.g., the attack success rate drops to 0% on CIFAR10.
@inproceedings{paperbot6685,
title = {Attack as defense: characterizing adversarial examples using robustness},
author = {Zhe Zhao and Guangke Chen and Jingyi Wang and Yiwei Yang and Fu Song and Jun Sun},
booktitle = {ISSTA},
year = {2021},
doi = {10.1145/3460319.3464822}
}