Deep neural networks (DNNs) are known to have a fundamental sensitivity to
adversarial attacks, perturbations of the input that are imperceptible to
humans yet powerful enough to change the visual decision of a model.
Adversarial attacks have long been considered the "Achilles' heel" of deep
learning, which may eventually force a shift in modeling paradigms.
Nevertheless, the formidable capabilities of modern large-scale DNNs have
somewhat eclipsed these early concerns. Do adversarial attacks continue to pose
a threat to DNNs?
Here, we investigate how the robustness of DNNs to adversarial attacks has
evolved as their accuracy on ImageNet has continued to improve. We measure
adversarial robustness in two different ways: First, we measure the smallest
adversarial attack needed to cause a model to change its object categorization
decision. Second, we measure how aligned successful attacks are with the
features that humans find diagnostic for object recognition. We find that
adversarial attacks are inducing bigger and more easily detectable changes to
image pixels as DNNs grow better on ImageNet, but these attacks are also
becoming less aligned with features that humans find diagnostic for
recognition. To better understand the source of this trade-off, we turn to the
neural harmonizer, a DNN training routine that encourages models to leverage
the same features as humans to solve tasks. Harmonized DNNs achieve the best of
both worlds and experience attacks that are detectable and affect features that
humans find diagnostic for recognition, meaning that attacks on these models
are more likely to be rendered ineffective by inducing similar effects on human
perception. Our findings suggest that the sensitivity of DNNs to adversarial
attacks can be mitigated by DNN scale, data scale, and training routines that
align models with biological intelligence.

通过研究和比较多种神经网络，本文发现随着图片识别准确度的提高，对抗性攻击虽然越来越容易使模型改变分类决策，但同时攻击的特征也越来越远离与人类视觉识别相关的特征，即使人工以同样方式造成的影响。而通过神经协调器网络的训练，可以使神经网络更加接近人类视觉识别应有模式，从而提高对抗性攻击下的鲁棒性。

对抗性对齐：打破攻击强度和其对人类感知的相关性之间的权衡

Adversarial alignment: Breaking the trade-off between the strength of an  attack and its relevance to human perception

The many successes of deep neural networks (DNNs) over the past decade have
largely been driven by computational scale rather than insights from biological
intelligence. Here, we explore if these trends have also carried concomitant
improvements in explaining the visual strategies humans rely on for object
recognition. We do this by comparing two related but distinct properties of
visual strategies in humans and DNNs: where they believe important visual
features are in images and how they use those features to categorize objects.
Across 84 different DNNs trained on ImageNet and three independent datasets
measuring the where and the how of human visual strategies for object
recognition on those images, we find a systematic trade-off between DNN
categorization accuracy and alignment with human visual strategies for object
recognition. State-of-the-art DNNs are progressively becoming less aligned with
humans as their accuracy improves. We rectify this growing issue with our
neural harmonizer: a general-purpose training routine that both aligns DNN and
human visual strategies and improves categorization accuracy. Our work
represents the first demonstration that the scaling laws that are guiding the
design of DNNs today have also produced worse models of human vision. We
release our code and data at this https URL to help
the field build more human-like DNNs.

研究发现，尽管深度神经网络（DNNs）的成功主要是由于计算规模，而不是基于生物智能的洞见，但是随着精度的提高，DNNs 与人类视觉策略的一致性逐渐降低，但是神经谐振器的出现可以使 DNNs 与人类的视觉策略相一致并提高分类精度。