标题： 在检测对抗性扰动方面 显示英文标题

标题： On Detecting Adversarial Perturbations

摘要： 近年来，机器学习特别是深度学习在感知任务方面取得了巨大进展。 然而，它仍然容易受到经过专门设计的对抗性扰动的影响，这些扰动对人类来说几乎不可察觉，但却能欺骗系统。 在这项工作中，我们提出通过添加一个小型的“检测器”子网络来增强深度神经网络，该子网络在二分类任务上进行训练，以区分真实数据和包含对抗性扰动的数据。 我们的方法与以往针对对抗性扰动的工作是正交的，以往的工作主要集中在使分类网络本身更加鲁棒。 我们通过实验证明，即使对抗性扰动对人类几乎不可察觉，它们也可以被检测到，这令人惊讶。 此外，尽管检测器仅被训练来检测特定的对手，但它们可以推广到类似和较弱的对手。 此外，我们提出了一种同时欺骗分类器和检测器的对抗性攻击，并提出了一种新的检测器训练过程，以抵消这种攻击。 显示英文摘要

摘要： Machine learning and deep learning in particular has advanced tremendously on perceptual tasks in recent years. However, it remains vulnerable against adversarial perturbations of the input that have been crafted specifically to fool the system while being quasi-imperceptible to a human. In this work, we propose to augment deep neural networks with a small "detector" subnetwork which is trained on the binary classification task of distinguishing genuine data from data containing adversarial perturbations. Our method is orthogonal to prior work on addressing adversarial perturbations, which has mostly focused on making the classification network itself more robust. We show empirically that adversarial perturbations can be detected surprisingly well even though they are quasi-imperceptible to humans. Moreover, while the detectors have been trained to detect only a specific adversary, they generalize to similar and weaker adversaries. In addition, we propose an adversarial attack that fools both the classifier and the detector and a novel training procedure for the detector that counteracts this attack.