The security issues in DNNs, such as adversarial examples, have attracted
much attention. Adversarial examples refer to the examples which are capable to
induce the DNNs return completely predictions by introducing carefully designed
perturbations. Obviously, adversarial examples bring great security risks to
the development of deep learning. Recently, Some defense approaches against
adversarial examples have been proposed, however, in our opinion, the
performance of these approaches are still limited. In this paper, we propose a
new ensemble defense approach named the Negative Correlation Ensemble (NCEn),
which achieves compelling results by introducing gradient directions and
gradient magnitudes of each member in the ensemble negatively correlated and at
the same time, reducing the transferability of adversarial examples among them.
Extensive experiments have been conducted, and the results demonstrate that
NCEn can improve the adversarial robustness of ensembles effectively.

该论文提出一个名为 NCEn 的新的集成防御方法，通过将每个成员的梯度方向和梯度幅度负相关地引入，同时减少它们之间对抗性示例的可传递性，以提高集合的对抗鲁棒性。

通过负相关模型集成来防御对抗样本

Defending Adversarial Examples by Negative Correlation Ensemble

Deep learning models have shown incredible performance on numerous image
recognition, classification, and reconstruction tasks. Although very appealing
and valuable due to their predictive capabilities, one common threat remains
challenging to resolve. A specifically trained attacker can introduce malicious
input perturbations to fool the network, thus causing potentially harmful
mispredictions. Moreover, these attacks can succeed when the adversary has full
access to the target model (white-box) and even when such access is limited
(black-box setting). The ensemble of models can protect against such attacks
but might be brittle under shared vulnerabilities in its members (attack
transferability). To that end, this work proposes a novel diversity-promoting
learning approach for the deep ensembles. The idea is to promote saliency map
diversity (SMD) on ensemble members to prevent the attacker from targeting all
ensemble members at once by introducing an additional term in our learning
objective. During training, this helps us minimize the alignment between model
saliencies to reduce shared member vulnerabilities and, thus, increase ensemble
robustness to adversaries. We empirically show a reduced transferability
between ensemble members and improved performance compared to the
state-of-the-art ensemble defense against medium and high strength white-box
attacks. In addition, we demonstrate that our approach combined with existing
methods outperforms state-of-the-art ensemble algorithms for defense under
white-box and black-box attacks.

提出一种基于多样性促进学习的深度集成方法，提高深度集成模型抵抗对手攻击的能力，减少攻击的迁移效应，实现更好的白盒和黑盒攻击防御性能。

多元突出感知深度集成提高对抗性鲁棒性

Saliency Diversified Deep Ensemble for Robustness to Adversaries

Recent advances in attention-based networks have shown that Vision
Transformers can achieve state-of-the-art or near state-of-the-art results on
many image classification tasks. This puts transformers in the unique position
of being a promising alternative to traditional convolutional neural networks
(CNNs). While CNNs have been carefully studied with respect to adversarial
attacks, the same cannot be said of Vision Transformers. In this paper, we
study the robustness of Vision Transformers to adversarial examples. Our
analyses of transformer security is divided into three parts. First, we test
the transformer under standard white-box and black-box attacks. Second, we
study the transferability of adversarial examples between CNNs and
transformers. We show that adversarial examples do not readily transfer between
CNNs and transformers. Based on this finding, we analyze the security of a
simple ensemble defense of CNNs and transformers. By creating a new attack, the
self-attention blended gradient attack, we show that such an ensemble is not
secure under a white-box adversary. However, under a black-box adversary, we
show that an ensemble can achieve unprecedented robustness without sacrificing
clean accuracy. Our analysis for this work is done using six types of white-box
attacks and two types of black-box attacks. Our study encompasses multiple
Vision Transformers, Big Transfer Models and CNN architectures trained on
CIFAR-10, CIFAR-100 and ImageNet.

本文研究了 Vision Transformers 在对抗性样本方面的鲁棒性，分析了其与 CNNs 在攻击和安全方面的不同，并提出了一个简单的混合防御方案以提高鲁棒性和准确性。

Vision Transformers 对抗样本的鲁棒性

On the Robustness of Vision Transformers to Adversarial Examples

The rapidly growing body of research in adversarial machine learning has
demonstrated that deep neural networks (DNNs) are highly vulnerable to
adversarially generated images. This underscores the urgent need for practical
defense that can be readily deployed to combat attacks in real-time. Observing
that many attack strategies aim to perturb image pixels in ways that are
visually imperceptible, we place JPEG compression at the core of our proposed
Shield defense framework, utilizing its capability to effectively "compress
away" such pixel manipulation. To immunize a DNN model from artifacts
introduced by compression, Shield "vaccinates" a model by re-training it with
compressed images, where different compression levels are applied to generate
multiple vaccinated models that are ultimately used together in an ensemble
defense. On top of that, Shield adds an additional layer of protection by
employing randomization at test time that compresses different regions of an
image using random compression levels, making it harder for an adversary to
estimate the transformation performed. This novel combination of vaccination,
ensembling, and randomization makes Shield a fortified multi-pronged
protection. We conducted extensive, large-scale experiments using the ImageNet
dataset, and show that our approaches eliminate up to 94% of black-box attacks
and 98% of gray-box attacks delivered by the recent, strongest attacks, such as
Carlini-Wagner's L2 and DeepFool. Our approaches are fast and work without
requiring knowledge about the model.

本研究提出了一个名为 Shield 的防御框架，利用 JPEG 压缩和不同压缩级别生成多个被疫苗化的模型来加固深度神经网络模型并保护其免受外部攻击。实验结果表明，Shield 在抵御最新、最强攻击方面的表现优异，能够消除高达 94% 的黑箱攻击和 98% 的灰箱攻击。