Deep neural networks (DNNs) could be deceived by generating
human-imperceptible perturbations of clean samples. Therefore, enhancing the
robustness of DNNs against adversarial attacks is a crucial task. In this
paper, we aim to train robust DNNs by limiting the set of outputs reachable via
a norm-bounded perturbation added to a clean sample. We refer to this set as
adversarial polytope, and each clean sample has a respective adversarial
polytope. Indeed, if the respective polytopes for all the samples are compact
such that they do not intersect the decision boundaries of the DNN, then the
DNN is robust against adversarial samples. Hence, the inner-working of our
algorithm is based on learning \textbf{c}onfined \textbf{a}dversarial
\textbf{p}olytopes (CAP). By conducting a thorough set of experiments, we
demonstrate the effectiveness of CAP over existing adversarial robustness
methods in improving the robustness of models against state-of-the-art attacks
including AutoAttack.

通过限制对干净样本添加范数约束的微小扰动后得到的输出可达集合，我们旨在训练出对抗攻击具有强鲁棒性的深度神经网络。我们称这个集合为对抗多面体，每个干净样本都对应一个对抗多面体。实际上，如果所有样本对应的多面体都是紧凑的，并且不与深度神经网络的决策边界相交，那么深度神经网络就能对抗攻击具有鲁棒性。因此，我们的算法的内部工作是基于学习受限的对抗多面体（CAP）。通过一系列实验证明了 CAP 相对于现有的对抗鲁棒性方法在提升模型对抗最先进攻击（包括 AutoAttack）的鲁棒性方面的有效性。