NeuroEvolution automates the generation of Artificial Neural Networks through
the application of techniques from Evolutionary Computation. The main goal of
these approaches is to build models that maximize predictive performance,
sometimes with an additional objective of minimizing computational complexity.
Although the evolved models achieve competitive results performance-wise, their
robustness to adversarial examples, which becomes a concern in
security-critical scenarios, has received limited attention. In this paper, we
evaluate the adversarial robustness of models found by two prominent
NeuroEvolution approaches on the CIFAR-10 image classification task: DENSER and
NSGA-Net. Since the models are publicly available, we consider white-box
untargeted attacks, where the perturbations are bounded by either the L2 or the
Linfinity-norm. Similarly to manually-designed networks, our results show that
when the evolved models are attacked with iterative methods, their accuracy
usually drops to, or close to, zero under both distance metrics. The DENSER
model is an exception to this trend, showing some resistance under the L2
threat model, where its accuracy only drops from 93.70% to 18.10% even with
iterative attacks. Additionally, we analyzed the impact of pre-processing
applied to the data before the first layer of the network. Our observations
suggest that some of these techniques can exacerbate the perturbations added to
the original inputs, potentially harming robustness. Thus, this choice should
not be neglected when automatically designing networks for applications where
adversarial attacks are prone to occur.

本文针对 CIFAR-10 图像分类任务，评估两种著名的神经进化算法（DENSER 和 NSGA-Net）找到的模型的对抗鲁棒性，结果表明，当这些模型遭受迭代攻击时，它们的精度通常会降至或接近零，而 DENSER 模型则对 L2 威胁模型表现出一定的抵御力，同时观察发现，对输入数据进行的一些预处理技术可能会加剧扰动，从而危害网络的性能。因此，自动设计网络时不应忽视这种影响，尤其是在容易受到对抗攻击的应用程序中。

神经进化方法的对抗鲁棒性评估

Adversarial Robustness Assessment of NeuroEvolution Approaches

This paper introduces NSGA-Net -- an evolutionary approach for neural
architecture search (NAS). NSGA-Net is designed with three goals in mind: (1) a
procedure considering multiple and conflicting objectives, (2) an efficient
procedure balancing exploration and exploitation of the space of potential
neural network architectures, and (3) a procedure finding a diverse set of
trade-off network architectures achieved in a single run. NSGA-Net is a
population-based search algorithm that explores a space of potential neural
network architectures in three steps, namely, a population initialization step
that is based on prior-knowledge from hand-crafted architectures, an
exploration step comprising crossover and mutation of architectures, and
finally an exploitation step that utilizes the hidden useful knowledge stored
in the entire history of evaluated neural architectures in the form of a
Bayesian Network. Experimental results suggest that combining the dual
objectives of minimizing an error metric and computational complexity, as
measured by FLOPs, allows NSGA-Net to find competitive neural architectures.
Moreover, NSGA-Net achieves error rate on the CIFAR-10 dataset on par with
other state-of-the-art NAS methods while using orders of magnitude less
computational resources. These results are encouraging and shows the promise to
further use of EC methods in various deep-learning paradigms.

本文介绍了 NSGA-Net，一种多目标优化的神经架构搜索算法，它通过使用前人先验知识，遗传算法（交叉和突变）以及贝叶斯网络等方式实现了对潜在神经网络结构的高效探索，从而找到一组多样的交换网络体系结构，并在 CIFAR-10 数据集上取得了与当前最先进的 NAS 方法相媲美的性能。