This paper presents RADAR-Robust Adversarial Detection via Adversarial
Retraining-an approach designed to enhance the robustness of adversarial
detectors against adaptive attacks, while maintaining classifier performance.
An adaptive attack is one where the attacker is aware of the defenses and
adapts their strategy accordingly. Our proposed method leverages adversarial
training to reinforce the ability to detect attacks, without compromising clean
accuracy. During the training phase, we integrate into the dataset adversarial
examples, which were optimized to fool both the classifier and the adversarial
detector, enabling the adversarial detector to learn and adapt to potential
attack scenarios. Experimental evaluations on the CIFAR-10 and SVHN datasets
demonstrate that our proposed algorithm significantly improves a detector's
ability to accurately identify adaptive adversarial attacks -- without
sacrificing clean accuracy.

针对自适应攻击提出了一种名为 RADAR-Robust Adversarial Detection via Adversarial Retraining 的方法，旨在增强对抗性检测器的鲁棒性，同时保持分类器的性能。在训练阶段，我们将优化后的对抗性样本集成到数据集中，使对抗性检测器能够学习和适应潜在的攻击场景，从而显著提高检测器准确识别自适应对抗性攻击的能力，而不会损害净准确性。

增强守护者而非宝藏：适应性对抗性检测器

Fortify the Guardian, Not the Treasure: Resilient Adversarial Detectors

Adversarial Training (AT), which adversarially perturb the input samples
during training, has been acknowledged as one of the most effective defenses
against adversarial attacks, yet suffers from a fundamental tradeoff that
inevitably decreases clean accuracy. Instead of perturbing the samples,
Sharpness-Aware Minimization (SAM) perturbs the model weights during training
to find a more flat loss landscape and improve generalization. However, as SAM
is designed for better clean accuracy, its effectiveness in enhancing
adversarial robustness remains unexplored. In this work, considering the
duality between SAM and AT, we investigate the adversarial robustness derived
from SAM. Intriguingly, we find that using SAM alone can improve adversarial
robustness. To understand this unexpected property of SAM, we first provide
empirical and theoretical insights into how SAM can implicitly learn more
robust features, and conduct comprehensive experiments to show that SAM can
improve adversarial robustness notably without sacrificing any clean accuracy,
shedding light on the potential of SAM to be a substitute for AT when accuracy
comes at a higher priority. Code is available at
this https URL

通过对比 Adversarial Training (AT) 和 Sharpness-Aware Minimization (SAM) 的对偶关系，本研究发现单独使用 SAM 可以提高对抗性稳健性，同时不牺牲准确性，这为将 SAM 作为准确性较高的替代方案提供了新的可能性。