Adversarial training is an effective methodology for training deep neural networks that are robust against adversarial, norm-bounded perturbations. However, the computational cost of adversarial training grows prohibitively as the size of the model and number of input dimensions increase. Further, training against less expensive and therefore weaker adversaries produces models that are robust against weak attacks but break down under attacks that are stronger. This is often attributed to the phenomenon of gradient obfuscation; such models have a highly non-linear loss surface in the vicinity of training examples, making it hard for gradient-based attacks to succeed even though adversarial examples still exist. In this work, we introduce a novel regularizer that encourages the loss to behave linearly in the vicinity of the training data, thereby penalizing gradient obfuscation while encouraging robustness. We show via extensive experiments on CIFAR-10 and ImageNet, that models trained with our regularizer avoid gradient obfuscation and can be trained significantly faster than adversarial training. Using this regularizer, we exceed current state of the art and achieve 47% adversarial accuracy for ImageNet with l-infinity adversarial perturbations of radius 4/255 under an untargeted, strong, white-box attack. Additionally, we match state of the art results for CIFAR-10 at 8/255.

本文介绍了一种新型的正则化方法，该正则化方法鼓励在训练数据附近的损失行为呈线性，从而惩罚梯度混淆并鼓励鲁棒性。通过在 CIFAR-10 和 ImageNet 上的大量实验，我们展示了使用我们的正则化方法训练的模型避免了梯度混淆，并且比对抗训练能够更快地训练。使用这种正则化方法，我们在 ImageNet 上取得了 47% 的对抗准确率和 8/255的和 CIFAR-10 同样的表现。

局部线性化对抗鲁棒性