The deep neural networks are known to be vulnerable to well-designed
adversarial attacks. The most successful defense technique based on adversarial
training (AT) can achieve optimal robustness against particular attacks but
cannot generalize well to unseen attacks. Another effective defense technique
based on adversarial purification (AP) can enhance generalization but cannot
achieve optimal robustness. Meanwhile, both methods share one common limitation
on the degraded standard accuracy. To mitigate these issues, we propose a novel
framework called Adversarial Training on Purification (AToP), which comprises
two components: perturbation destruction by random transforms (RT) and purifier
model fine-tuned (FT) by adversarial loss. RT is essential to avoid
overlearning to known attacks resulting in the robustness generalization to
unseen attacks and FT is essential for the improvement of robustness. To
evaluate our method in an efficient and scalable way, we conduct extensive
experiments on CIFAR-10, CIFAR-100, and ImageNette to demonstrate that our
method achieves state-of-the-art results and exhibits generalization ability
against unseen attacks.

在这篇论文中，研究人员提出了一种称为对抗训练纯化（AToP）的新框架，通过随机转换（RT）的扰动破坏和对抗损失下的纯化模型优化（FT）来加强深度神经网络对抗攻击的鲁棒性和泛化能力，并通过对 CIFAR-10、CIFAR-100 和 ImageNette 的广泛实验表明其在对抗攻击防御方面达到了最先进的结果和泛化能力。