Building upon Randomized Discretization, we develop two novel adversarial
defenses against white-box PGD attacks, utilizing vector quantization in higher
dimensional spaces. These methods, termed pRD and swRD, not only offer a
theoretical guarantee in terms of certified accuracy, they are also shown, via
abundant experiments, to perform comparably or even superior to the current art
of adversarial defenses. These methods can be extended to a version that allows
further training of the target classifier and demonstrates further improved
performance.

利用高维向量量化的随机离散化方法，提出了两种新的对抗性防御方法 pRD 和 swRD。这些方法不仅在保证证明准确性方面具有理论保证，而且通过大量实验结果表明，它们的性能相当，甚至优于当前艺术的对抗性防御。这些方法可以扩展到允许目标分类器进一步训练，并且表现出更好的性能。

基于向量量化的对抗性防御

Adversarial Defenses via Vector Quantization

We demonstrate that the Conditional Entropy Bottleneck (CEB) can improve
model robustness. CEB is an easy strategy to implement and works in tandem with
data augmentation procedures. We report results of a large scale adversarial
robustness study on CIFAR-10, as well as the ImageNet-C Common Corruptions
Benchmark, ImageNet-A, and PGD attacks.

本研究通过使用条件熵瓶颈来提高模型的鲁棒性，在 CIFAR-10 数据集，ImageNet-C 通用破坏基准测试，以及 ImageNet-A 和 PGD 攻击测试中得到了更好的结果，同时结合数据增强方法使用。

CEB 提高模型鲁棒性

CEB Improves Model Robustness

Adversarial training, a method for learning robust deep networks, is
typically assumed to be more expensive than traditional training due to the
necessity of constructing adversarial examples via a first-order method like
projected gradient decent (PGD). In this paper, we make the surprising
discovery that it is possible to train empirically robust models using a much
weaker and cheaper adversary, an approach that was previously believed to be
ineffective, rendering the method no more costly than standard training in
practice. Specifically, we show that adversarial training with the fast
gradient sign method (FGSM), when combined with random initialization, is as
effective as PGD-based training but has significantly lower cost. Furthermore
we show that FGSM adversarial training can be further accelerated by using
standard techniques for efficient training of deep networks, allowing us to
learn a robust CIFAR10 classifier with 45% robust accuracy to PGD attacks with
$\epsilon=8/255$ in 6 minutes, and a robust ImageNet classifier with 43% robust
accuracy at $\epsilon=2/255$ in 12 hours, in comparison to past work based on
"free" adversarial training which took 10 and 50 hours to reach the same
respective thresholds. Finally, we identify a failure mode referred to as
"catastrophic overfitting" which may have caused previous attempts to use FGSM
adversarial training to fail. All code for reproducing the experiments in this
paper as well as pretrained model weights are at
this https URL

通过使用快速梯度符号方法（FGSM）来作为对抗样本的构造方法，使得对抗训练的代价不比标准训练更高，而且 FGSM 对抗训练与 PGD 对抗训练效果相当。最后，我们还研究了 FGSM 对抗训练的 “灾难性过拟合” 失败模式。

快速优于免费：再探对抗训练

Fast is better than free: Revisiting adversarial training

Adversarial training, in which a network is trained on adversarial examples,
is one of the few defenses against adversarial attacks that withstands strong
attacks. Unfortunately, the high cost of generating strong adversarial examples
makes standard adversarial training impractical on large-scale problems like
ImageNet. We present an algorithm that eliminates the overhead cost of
generating adversarial examples by recycling the gradient information computed
when updating model parameters. Our "free" adversarial training algorithm
achieves comparable robustness to PGD adversarial training on the CIFAR-10 and
CIFAR-100 datasets at negligible additional cost compared to natural training,
and can be 7 to 30 times faster than other strong adversarial training methods.
Using a single workstation with 4 P100 GPUs and 2 days of runtime, we can train
a robust model for the large-scale ImageNet classification task that maintains
40% accuracy against PGD attacks. The code is available at
this https URL

通过回收在更新模型参数过程中计算的渐变信息，提出了一种消除生成对抗样本开销的自由对抗训练算法，这个算法在 CIFAR-10 和 CIFAR-100 上达到了与 PGD 对抗训练相当的稳健性，其相比于自然训练的额外成本微不足道，并且可以比其他强对抗训练方法快 7 ~ 30 倍。使用单个带 4 个 P100 GPU 的工作站和 2 天运行时间，我们可以训练出针对大规模 ImageNet 分类任务的稳健模型，其对 PGD 攻击的准确率仍可保持在 40％ 左右。