Adversarial Training is proved to be an efficient method to defend against adversarial examples, being one of the few defenses that withstand strong attacks. However, traditional defense mechanisms assume a uniform attack over the examples according to the underlying data distribution, which is apparently unrealistic as the attacker could choose to focus on more vulnerable examples. We present a weighted minimax risk optimization that defends against non-uniform attacks, achieving robustness against adversarial examples under perturbed test data distributions. Our modified risk considers importance weights of different adversarial examples and focuses adaptively on harder examples that are wrongly classified or at higher risk of being classified incorrectly. The designed risk allows the training process to learn a strong defense through optimizing the importance weights. The experiments show that our model significantly improves state-of-the-art adversarial accuracy under non-uniform attacks without a significant drop under uniform attacks.

本文提出一种基于加权最小化风险优化方法的防御策略，通过优先考虑更易受攻击的样本，可以在不均衡攻击下实现防御，并通过实验证明了该模型在非均衡攻击下取得了明显的改进，而在均衡攻击下平均正确率并未显著下降。

对抗性样本是否平等？一种可学习的加权极小最大风险方法，用于对非均匀攻击进行鲁棒性保护