Neural networks are vulnerable to adversarial attacks -- small visually imperceptible crafted noise which when added to the input drastically changes the output. The most effective method of defending against these adversarial attacks is to use the methodology of adversarial training. We analyze the adversarially trained robust models to study their vulnerability against adversarial attacks at the level of the latent layers. Our analysis reveals that contrary to the input layer which is robust to adversarial attack, the latent layer of these robust models are highly susceptible to adversarial perturbations of small magnitude. Leveraging this information, we introduce a new technique Latent Adversarial Training (LAT) which comprises of fine-tuning the adversarially trained models to ensure the robustness at the feature layers. We also propose Latent Attack (LA), a novel algorithm for construction of adversarial examples. LAT results in minor improvement in test accuracy and leads to a state-of-the-art adversarial accuracy against the universal first-order adversarial PGD attack which is shown for the MNIST, CIFAR-10, CIFAR-100 datasets.

本研究通过对鲁棒性模型的分析，发现相对于输入层抗攻击性较强的特征层是高度容易受到小幅度形变攻击的。在此基础上，我们提出了一种名为 LAT 的新技术，通过对已经进行对抗性训练的模型进行微调，以保证其特征层的鲁棒性。研究表明此方法对 MNIST、CIFAR-10 和 CIFAR-100 数据集的前沿对抗准确度有轻微提升。

利用对抗训练模型中的潜在层漏洞