We propose a novel understanding of Sharpness-Aware Minimization (SAM) in the
context of adversarial robustness. In this paper, we point out that both SAM
and adversarial training (AT) can be viewed as specific feature perturbations,
which improve adversarial robustness. However, we note that SAM and AT are
distinct in terms of perturbation strength, leading to different accuracy and
robustness trade-offs. We provide theoretical evidence for these claims in a
simplified model with rigorous mathematical proofs. Furthermore, we conduct
experiment to demonstrate that only utilizing SAM can achieve superior
adversarial robustness compared to standard training, which is an unexpected
benefit. As adversarial training can suffer from a decrease in clean accuracy,
we show that using SAM alone can improve robustness without sacrificing clean
accuracy. Code is available at this https URL

本文提出了一种新的对于锐度感知最小化（SAM）在对抗鲁棒性方面的理解，指出 SAM 和对抗训练（AT）都可以被视为特定的特征扰动，能够提高对抗鲁棒性，但两者在扰动强度上有所不同，换而言之，根据精度和鲁棒性的权衡不同。通过一个严谨的简化模型和理论证明，提供了这些观点的理论证据。此外，进行实验证明，仅使用 SAM 可以获得优于标准训练的对抗鲁棒性，这是意想不到的好处。

关于锐度感知最小化与对抗鲁棒性的关系

On the Relation between Sharpness-Aware Minimization and Adversarial  Robustness

In tasks like node classification, image segmentation, and named-entity
recognition we have a classifier that simultaneously outputs multiple
predictions (a vector of labels) based on a single input, i.e. a single graph,
image, or document respectively. Existing adversarial robustness certificates
consider each prediction independently and are thus overly pessimistic for such
tasks. They implicitly assume that an adversary can use different perturbed
inputs to attack different predictions, ignoring the fact that we have a single
shared input. We propose the first collective robustness certificate which
computes the number of predictions that are simultaneously guaranteed to remain
stable under perturbation, i.e. cannot be attacked. We focus on Graph Neural
Networks and leverage their locality property - perturbations only affect the
predictions in a close neighborhood - to fuse multiple single-node certificates
into a drastically stronger collective certificate. For example, on the
Citeseer dataset our collective certificate for node classification increases
the average number of certifiable feature perturbations from $7$ to $351$.

该研究提出了首个集合鲁棒性证明，该证明可以同时保证图灵网络的多个预测结果在扰动下的不可被攻击性，并结合其局部性质使用多个单节点证明来构建强大的集合证明。

集体鲁棒性证书：利用图神经网络中的相互依赖性

Collective Robustness Certificates: Exploiting Interdependence in Graph  Neural Networks

We propose MisMatch, a novel consistency-driven semi-supervised segmentation
framework which produces predictions that are invariant to learnt feature
perturbations. MisMatch consists of an encoder and a two-head decoders. One
decoder learns positive attention to the foreground regions of interest (RoI)
on unlabelled images thereby generating dilated features. The other decoder
learns negative attention to the foreground on the same unlabelled images
thereby generating eroded features. We then apply a consistency regularisation
on the paired predictions. MisMatch outperforms state-of-the-art
semi-supervised methods on a CT-based pulmonary vessel segmentation task and a
MRI-based brain tumour segmentation task. In addition, we show that the
effectiveness of MisMatch comes from better model calibration than its
supervised learning counterpart.

本研究提出了一种新颖的一致性驱动半监督分割框架，其通过对编码器和双头解码器进行训练来实现对预测结果的不变性，比传统的半监督方法在 CT 肺血管分割和 MRI 脑肿瘤分割任务上表现更好，并且表明了 MisMatch 相对于其监督学习对应物的更好模型校准方法的有效性。