论文标题
当前关于对抗性鲁棒性的研究是否解决了正确的问题？
Is current research on adversarial robustness addressing the right problem?
论文作者
论文摘要
简短答案：是的，长答案：不！确实，对对抗性鲁棒性的研究导致了宝贵的见解，帮助我们理解和探索问题的不同方面。在过去的几年中，已经提出了许多攻击和防御。然而，这个问题在很大程度上尚未解决，理解还不足。在这里，我认为该问题的当前表述实现了短期目标，需要对我们进行修订以获得更大的收益。具体而言，扰动的界限创造了一个人为的设置，需要放松。这使我们误导了我们专注于表达不足以开始的模型类。取而代之的是，受到人类视野的启发以及我们更多地依赖于诸如形状，顶点和前景对象之类的强大功能的事实，而不是纹理（例如纹理），应努力寻找明显不同的模型类别。也许我们应该攻击一个更普遍的问题，而不是缩小无法察觉的对抗性扰动，而是在寻找与可感知的扰动，几何变换（例如旋转，缩放），图像失真（照明，模糊）等同时稳健的体系结构。只有这样，我们也许才能解决对抗脆弱性的问题。
Short answer: Yes, Long answer: No! Indeed, research on adversarial robustness has led to invaluable insights helping us understand and explore different aspects of the problem. Many attacks and defenses have been proposed over the last couple of years. The problem, however, remains largely unsolved and poorly understood. Here, I argue that the current formulation of the problem serves short term goals, and needs to be revised for us to achieve bigger gains. Specifically, the bound on perturbation has created a somewhat contrived setting and needs to be relaxed. This has misled us to focus on model classes that are not expressive enough to begin with. Instead, inspired by human vision and the fact that we rely more on robust features such as shape, vertices, and foreground objects than non-robust features such as texture, efforts should be steered towards looking for significantly different classes of models. Maybe instead of narrowing down on imperceptible adversarial perturbations, we should attack a more general problem which is finding architectures that are simultaneously robust to perceptible perturbations, geometric transformations (e.g. rotation, scaling), image distortions (lighting, blur), and more (e.g. occlusion, shadow). Only then we may be able to solve the problem of adversarial vulnerability.
