Our research aims to unify existing works' diverging opinions on how architectural components affect the adversarial robustness of CNNs. To accomplish our goal, we synthesize a suite of three generalizable robust architectural design principles: (a) optimal range for depth and width configurations, (b) preferring convolutional over patchify stem stage, and (c) robust residual block design through adopting squeeze and excitation blocks and non-parametric smooth activation functions. Through extensive experiments across a wide spectrum of dataset scales, adversarial training methods, model parameters, and network design spaces, our principles consistently and markedly improve AutoAttack accuracy: 1-3 percentage points (pp) on CIFAR-10 and CIFAR-100, and 4-9 pp on ImageNet. The code is publicly available at https://github.com/poloclub/robust-principles.

我们研究的目标是统一现有作品在架构组件如何影响CNN的对抗鲁棒性方面的分歧意见。为了实现我们的目标，我们综合了三个可推广的鲁棒架构设计原则：(a) 深度和宽度配置的最佳范围，(b) 优先使用卷积而非拼贴块的初始阶段，和 (c) 通过采用挤压和激励块以及非参数平滑激活函数的鲁棒残差块设计。通过在广泛的数据集规模、对抗训练方法、模型参数和网络设计空间上进行大量实验证明，我们的原则始终显著提高 AutoAttack 的准确性：CIFAR-10 和 CIFAR-100 上为 1-3 个百分点 (pp)，ImageNet 上为 4-9 个百分点 (pp)。代码可以公开访问该 URL。

稳健原则：对抗稳健CNN的架构设计原则