Recent research finds CNN models for image classification demonstrate
overlapped adversarial vulnerabilities: adversarial attacks can mislead CNN
models with small perturbations, which can effectively transfer between
different models trained on the same dataset. Adversarial training, as a
general robustness improvement technique, eliminates the vulnerability in a
single model by forcing it to learn robust features. The process is hard, often
requires models with large capacity, and suffers from significant loss on clean
data accuracy. Alternatively, ensemble methods are proposed to induce
sub-models with diverse outputs against a transfer adversarial example, making
the ensemble robust against transfer attacks even if each sub-model is
individually non-robust. Only small clean accuracy drop is observed in the
process. However, previous ensemble training methods are not efficacious in
inducing such diversity and thus ineffective on reaching robust ensemble. We
propose DVERGE, which isolates the adversarial vulnerability in each sub-model
by distilling non-robust features, and diversifies the adversarial
vulnerability to induce diverse outputs against a transfer attack. The novel
diversity metric and training procedure enables DVERGE to achieve higher
robustness against transfer attacks comparing to previous ensemble methods, and
enables the improved robustness when more sub-models are added to the ensemble.
The code of this work is available at this https URL

研究发现，针对图像分类的 CNN 模型存在重叠的对抗性漏洞，DVERGE 通过提取非鲁棒特征并使对抗性漏洞多样化，实现了针对转移攻击的高鲁棒性。