Recently, Wong et al. showed that adversarial training with single-step FGSM
leads to a characteristic failure mode named Catastrophic Overfitting (CO), in
which a model becomes suddenly vulnerable to multi-step attacks. Experimentally
they showed that simply adding a random perturbation prior to FGSM (RS-FGSM)
could prevent CO. However, Andriushchenko and Flammarion observed that RS-FGSM
still leads to CO for larger perturbations, and proposed a computationally
expensive regularizer (GradAlign) to avoid it. In this work, we methodically
revisit the role of noise and clipping in single-step adversarial training.
Contrary to previous intuitions, we find that using a stronger noise around the
clean sample combined with \textit{not clipping} is highly effective in
avoiding CO for large perturbation radii. We then propose Noise-FGSM (N-FGSM)
that, while providing the benefits of single-step adversarial training, does
not suffer from CO. Empirical analyses on a large suite of experiments show
that N-FGSM is able to match or surpass the performance of previous
state-of-the-art GradAlign, while achieving 3x speed-up. Code can be found in
this https URL

本文重访了单步对抗训练中噪声与剪辑的角色，发现使用强噪声结合不剪辑非常有效地避免了大扰动半径下的灾难性过拟合，提出了 Noise-FGSM (N-FGSM)，实验结果表明 N-FGSM 能达到甚至超过之前的 GradAlign，同时提高了 3 倍的速度。

制造噪声：可靠高效的单步对抗训练

Make Some Noise: Reliable and Efficient Single-Step Adversarial Training

Two-party split learning is a popular technique for learning a model across
feature-partitioned data. In this work, we explore whether it is possible for
one party to steal the private label information from the other party during
split training, and whether there are methods that can protect against such
attacks. Specifically, we first formulate a realistic threat model and propose
a privacy loss metric to quantify label leakage in split learning. We then show
that there exist two simple yet effective methods within the threat model that
can allow one party to accurately recover private ground-truth labels owned by
the other party. To combat these attacks, we propose several random
perturbation techniques, including $\texttt{Marvell}$, an approach that
strategically finds the structure of the noise perturbation by minimizing the
amount of label leakage (measured through our quantification metric) of a
worst-case adversary. We empirically demonstrate the effectiveness of our
protection techniques against the identified attacks, and show that
$\texttt{Marvell}$ in particular has improved privacy-utility tradeoffs
relative to baseline approaches.

本研究探索了在双方分别拥有数据的场景下，一方能否窃取另一方的标签信息，并提出了量化泄露度的隐私损失度量、防御方法和基于随机扰动的修复技术 $	exttt {Marvell}$。实验证明，该技术具有更好的隐私效果和使用效用权衡。

两方分裂学习中的标签泄露和保护

Label Leakage and Protection in Two-party Split Learning

We analyze linear independence of rank one tensors produced by tensor powers
of randomly perturbed vectors. This enables efficient decomposition of sums of
high-order tensors. Our analysis builds upon [BCMV14] but allows for a wider
range of perturbation models, including discrete ones. We give an application
to recovering assemblies of neurons.
Assemblies are large sets of neurons representing specific memories or
concepts. The size of the intersection of two assemblies has been shown in
experiments to represent the extent to which these memories co-occur or these
concepts are related; the phenomenon is called association of assemblies. This
suggests that an animal's memory is a complex web of associations, and poses
the problem of recovering this representation from cognitive data. Motivated by
this problem, we study the following more general question: Can we reconstruct
the Venn diagram of a family of sets, given the sizes of their $\ell$-wise
intersections? We show that as long as the family of sets is randomly
perturbed, it is enough for the number of measurements to be polynomially
larger than the number of nonempty regions of the Venn diagram to fully
reconstruct the diagram.

本文研究了张量分解、神经元集合、集合交并、Venn 图、随机扰动等问题，提出可通过随机扰动的方法，利用多项式级别的次数测量结果，重构具有非空区域的随机扰动下的 Venn 图。