In this paper, we consider the problem of assessing the adversarial robustness of deep neural network models under both Markov chain Monte Carlo (MCMC) and Bayesian Dark Knowledge (BDK) inference approximations. We characterize the robustness of each method to two types of adversarial attacks: the fast gradient sign method (FGSM) and projected gradient descent (PGD). We show that full MCMC-based inference has excellent robustness, significantly outperforming standard point estimation-based learning. On the other hand, BDK provides marginal improvements. As an additional contribution, we present a storage-efficient approach to computing adversarial examples for large Monte Carlo ensembles using both the FGSM and PGD attacks.

本文考虑在Markov chain Monte Carlo（MCMC）和Bayesian Dark Knowledge（BDK）推断近似下评估深度神经网络模型对于对抗攻击的抵抗力的问题，并且比较了全MCMC推断和BDK对于快速梯度符号方法（FGSM）和投影梯度下降（PGD）两类对抗攻击的鲁棒性。结果表明，全MCMC推断具有出色的鲁棒性，显著优于标准点估计学习，而BDK提供了较小的提升，此外，我们还提出了一种存储效率高的方法，用于使用FGSM和PGD攻击计算大型蒙特卡罗集合的对抗性示例。

评估蒙特卡罗和蒸馏方法对深度贝叶斯神经网络分类的对抗鲁棒性