motivation
用两个BN(一个用于干净样本, 一个用于对抗样本), 结果当使用
B
N
n
a
t
\mathrm{BN}_{nat}
BNnat的时候, 精度能够上升, 而使用
B
N
a
d
v
\mathrm{BN}_{adv}
BNadv的时候, 也有相当的鲁棒性. 原文采用的是
α
L
(
f
(
x
)
,
y
)
+
(
1
−
α
)
L
(
f
(
x
+
δ
)
,
y
)
,
\alpha \mathcal{L}(f(x), y) + (1-\alpha) \mathcal{L}(f(x+\delta), y),
αL(f(x),y)+(1−α)L(f(x+δ),y),
来训练(这里
f
(
x
)
f(x)
f(x)输出的是概率向量而非logits), 试试看别的组合方式, 比如
L
(
α
f
(
x
n
a
t
)
+
(
1
−
α
)
f
(
x
a
d
v
)
,
y
)
.
\mathcal{L}(\alpha f(x_{nat}) + (1-\alpha)f(x_{adv}) ,y).
L(αf(xnat)+(1−α)f(xadv),y).
settings
Attribute | Value |
---|---|
attack | pgd-linf |
batch_size | 128 |
beta1 | 0.9 |
beta2 | 0.999 |
dataset | cifar10 |
description | AT=0.5=default-sgd-0.1=pgd-linf-0.0314-0.25-10=128=default |
epochs | 100 |
epsilon | 0.03137254901960784 |
learning_policy | [50, 75] x 0.1 |
leverage | 0.5 |
loss | cross_entropy |
lr | 0.1 |
model | resnet32 |
momentum | 0.9 |
optimizer | sgd |
progress | False |
resume | False |
seed | 1 |
stats_log | False |
steps | 10 |
stepsize | 0.25 |
transform | default |
weight_decay | 0.0005 |
results
x轴为 α \alpha α从 0 0 0变化到 1 1 1.
Accuracy | Robustness | |
---|---|---|
0.5 L n a t + 0.5 L a d v 0.5 \mathcal{L}_{nat} + 0.5\mathcal{L}_{adv} 0.5Lnat+0.5Ladv | ![]() | ![]() |
L ( 0.5 p n a t + 0.5 p a d v , y ) \mathcal{L}(0.5 p_{nat} + 0.5p_{adv}, y) L(0.5pnat+0.5padv,y) | ![]() | ![]() |
0.1 L n a t + 0.9 L a d v 0.1 \mathcal{L}_{nat} + 0.9\mathcal{L}_{adv} 0.1Lnat+0.9Ladv 48.350 | ![]() | ![]() |
L ( 0.1 p n a t + 0.9 p a d v , y ) \mathcal{L}(0.1 p_{nat} + 0.9p_{adv}, y) L(0.1pnat+0.9padv,y) 48.270 | ![]() | ![]() |
0.2 L n a t + 0.8 L a d v 0.2 \mathcal{L}_{nat} + 0.8\mathcal{L}_{adv} 0.2Lnat+0.8Ladv 48.310 | ![]() | ![]() |
L ( 0.2 p n a t + 0.8 p a d v , y ) \mathcal{L}(0.2 p_{nat} + 0.8p_{adv}, y) L(0.2pnat+0.8padv,y) 47.960 | ![]() | ![]() |
似乎原来的形式情况更好一点.