Related work
Szegedy et al.2014b《》:
- box-constrained L-BFGS 能可靠地找到对抗样本
- 在ImageNet等数据集上,对抗样本和原始样本的差距很小,人眼不可见
- 同样的对抗样本会被不同结构的分类器误判
- shallow softmax regression 同样对对抗样本很脆弱
- training on adversarial examples can regularize the moddel–however, this was not practical at the time due to the need for expensive constrained optimization in the inner loop
对抗样本的线性解释:
对线性模型的解释:
非线性模型的线性扰动
fast gradient sign method(FGS):
其他,在梯度方向上旋转x一个小角度也可以产生对抗样本