In this paper, we investigate the following question: Can we obtain adversarially-trained models without training on adversarial examples? Our intuition is that training a model with inherent stochasticity, i.e., optimizing the parameters by minimizing a stochastic loss function, yields a robust expectation function that is non-stochastic. In contrast to related methods that introduce noise at the input level, our proposed approach incorporates inherent stochasticity by embedding Gaussian noise within the layers of the NN model at training time. We model the propagation of noise through the layers, introducing a closed-form stochastic loss function that encapsulates a noise variance parameter. Additionally, we contribute a formalized noise-aware gradient, enabling the optimization of model parameters while accounting for stochasticity. Our experimental results confirm that the expectation model of a stochastic architecture trained on benign distribution is adversarially robust. Interestingly, we find that the impact of the applied Gaussian noise's standard deviation on both robustness and baseline accuracy closely mirrors the impact of the noise magnitude employed in adversarial training. Our work contributes adversarially trained networks using a completely different approach, with empirically similar robustness to adversarial training.

我们的研究目的在于探究一种不依赖对抗样本训练的对抗训练模型方法，通过在神经网络模型的层中嵌入高斯噪声以引入内在的随机性，并通过优化参数时考虑到随机性，我们证实了在正态分布训练下获得的随机体系结构模型在对抗环境中具有鲁棒性，并且发现所用的高斯噪声标准差对鲁棒性和基准准确性的影响与对抗训练中所使用的噪声大小影响相似。

愿噪声与你同在：没有对抗样本的对抗训练