Deep neural networks (DNNs) are known to be vulnerable to adversarial attacks. A range of defense methods have been proposed to train adversarially robust DNNs, among which adversarial training has demonstrated promising results. However, despite preliminary understandings developed for adversarial training, it is still not clear, from the architectural perspective, what configurations can lead to more robust DNNs. In this paper, we address this gap via a comprehensive investigation on the impact of network width and depth on the robustness of adversarially trained DNNs. Specifically, we make the following key observations: 1) more parameters (higher model capacity) does not necessarily help adversarial robustness; 2) reducing capacity at the last stage (the last group of blocks) of the network can actually improve adversarial robustness; and 3) under the same parameter budget, there exists an optimal architectural configuration for adversarial robustness. We also provide a theoretical analysis explaning why such network configuration can help robustness. These architectural insights can help design adversarially robust DNNs. Code is available at \url{https://github.com/HanxunH/RobustWRN}.

本文针对深度神经网络（DNN）易受到对抗攻击的问题，通过对网络结构的宽度和深度进行综合研究，发现更高的模型容量并不一定有助于对抗攻击抵抗力的提高，最后一个阶段降低容量实际上可以提高对抗攻击的鲁棒性，同样的参数预算下，存在一种最佳的结构以提高对抗攻击的鲁棒性，并提供了理论分析，这些架构可帮助进行设计更具对抗攻击鲁棒性的DNN。

探索对抗鲁棒深度神经网络的架构因素