标题： 经典的深度神经网络是否具有弱对抗鲁棒性？ 显示英文标题

标题： Are classical deep neural networks weakly adversarially robust?

摘要： 对抗性攻击受到了越来越多的关注，并且人们普遍认识到经典的深度神经网络（DNN）具有较弱的对抗鲁棒性。最常用的对抗防御方法——对抗训练，通过生成对抗样本并对模型进行再训练来提高DNN的对抗精度。然而，对抗训练需要显著的计算开销。 本文受到现有研究的启发，这些研究关注于每层DNN输出特征的聚类特性以及逐步前馈坍塌（Progressive Feedforward Collapse）现象，提出了一种基于逐层特征构建特征路径并计算样本特征路径与类别中心特征路径之间相关性的对抗样本检测和图像识别方法。实验结果显示，在ResNet-20上该识别方法达到了82.77%的清洁准确率和44.17%的对抗准确率。与清洁准确率为77.64%，对抗准确率为52.94%的对抗训练方法相比，我们的方法在不依赖昂贵计算防御策略的情况下展示了权衡效果。此外，在标准的ResNet-18上，我们的方法也保持了这一优势，相应的指标分别为80.01%和46.1%。这一结果揭示了DNN中固有的对抗鲁棒性，挑战了关于DNN弱对抗鲁棒性的传统理解。 显示英文摘要

摘要： Adversarial attacks have received increasing attention and it has been widely recognized that classical DNNs have weak adversarial robustness. The most commonly used adversarial defense method, adversarial training, improves the adversarial accuracy of DNNs by generating adversarial examples and retraining the model. However, adversarial training requires a significant computational overhead. In this paper, inspired by existing studies focusing on the clustering properties of DNN output features at each layer and the Progressive Feedforward Collapse phenomenon, we propose a method for adversarial example detection and image recognition that uses layer-wise features to construct feature paths and computes the correlation between the examples feature paths and the class-centered feature paths. Experimental results show that the recognition method achieves 82.77% clean accuracy and 44.17% adversarial accuracy on the ResNet-20 with PFC. Compared to the adversarial training method with 77.64% clean accuracy and 52.94% adversarial accuracy, our method exhibits a trade-off without relying on computationally expensive defense strategies. Furthermore, on the standard ResNet-18, our method maintains this advantage with respective metrics of 80.01% and 46.1%. This result reveals inherent adversarial robustness in DNNs, challenging the conventional understanding of the weak adversarial robustness in DNNs.