We present a simple yet effective method to improve the robustness of
Convolutional Neural Networks (CNNs) against adversarial examples by
post-processing an adversarially trained model. Our technique, MeanSparse,
cascades the activation functions of a trained model with novel operators that
sparsify mean-centered feature vectors. This is equivalent to reducing feature
variations around the mean, and we show that such reduced variations merely
affect the model's utility, yet they strongly attenuate the adversarial
perturbations and decrease the attacker's success rate. Our experiments show
that, when applied to the top models in the RobustBench leaderboard, it
achieves a new robustness record of 72.08% (from 71.07%) and 59.64% (from
59.56%) on CIFAR-10 and ImageNet, respectively, in term of AutoAttack accuracy.
Code is available at this https URL

我们提出了一种简单而有效的方法，通过对经过对抗训练的模型进行后处理，来提高卷积神经网络（CNNs）对抗性示例的鲁棒性。我们的技术 MeanSparse 将训练模型的激活函数级联到与平均中心化的特征向量稀疏化的新操作。我们展示了这种减小平均值周围特征变化对模型实用性几乎没有影响，但却能强烈抑制对抗扰动并降低攻击者的成功率。我们的实验证明，在 RobustBench 榜单上最顶尖的模型上应用该方法，在 AutoAttack 准确率上相对 CIFAR-10 和 ImageNet 分别提升到 72.08%（原来为 71.07%）和 59.64%（原来为 59.56%），取得了新的鲁棒性记录。更多详细信息请访问 https URL。