TriggerBN ++

Posted 2021-06-14 馒头and花卷

目录

• motivation
• settings
• results

motivation

用两个BN(一个用于干净样本, 一个用于对抗样本), 结果当使用\\(\\mathrm{BN}_{nat}\\)的时候, 精度能够上升, 而使用\\(\\mathrm{BN}_{adv}\\)的时候, 也有相当的鲁棒性. 原文采用的是

\\[\\alpha \\mathcal{L}(f(x), y) + (1-\\alpha) \\mathcal{L}(f(x+\\delta), y), \\]

来训练(这里\\(f(x)\\)输出的是概率向量而非logits), 试试看别的组合方式, 比如

\\[\\mathcal{L}(\\alpha f(x_{nat}) + (1-\\alpha)f(x_{adv}) ,y). \\]

settings

Attribute	Value
attack	pgd-linf
batch_size	128
beta1	0.9
beta2	0.999
dataset	cifar10
description	AT=0.5=default-sgd-0.1=pgd-linf-0.0314-0.25-10=128=default
epochs	100
epsilon	0.03137254901960784
learning_policy	[50, 75] x 0.1
leverage	0.5
loss	cross_entropy
lr	0.1
model	resnet32
momentum	0.9
optimizer	sgd
progress	False
resume	False
seed	1
stats_log	False
steps	10
stepsize	0.25
transform	default
weight_decay	0.0005

results

x轴为\\(\\alpha\\)从\\(0\\)变化到\\(1\\).

	Accuracy	Robustness
\\(0.5 \\mathcal{L}_{nat} + 0.5\\mathcal{L}_{adv}\\)
\\(\\mathcal{L}(0.5 p_{nat} + 0.5p_{adv}, y)\\)
\\(0.1 \\mathcal{L}_{nat} + 0.9\\mathcal{L}_{adv}\\) 48.350
\\(\\mathcal{L}(0.1 p_{nat} + 0.9p_{adv}, y)\\) 48.270
\\(0.2 \\mathcal{L}_{nat} + 0.8\\mathcal{L}_{adv}\\) 48.310
\\(\\mathcal{L}(0.2 p_{nat} + 0.8p_{adv}, y)\\) 47.960

似乎原来的形式情况更好一点.