对具有对抗性噪声的可压缩信号进行恢复保证

作者：Jasjeet Dhaliwal,Kyle Hambrook

摘要：我们为已经被噪声破坏的可压缩信号提供恢复保证，并扩展了[1]中引入的框架，以防御神经网络对抗l0范数和ℓ2范数攻击。具体地说，对于在某些变换域中近似稀疏并且已经被噪声扰动的信号，我们提供了在变换域中准确恢复信号的保证。然后，我们可以使用恢复的信号在其原始域中重建信号，同时在很大程度上消除噪声。我们的结果是通用的，因为它们可以直接应用于实际使用的大多数单位变换，并且适用于l0范数有界噪声和l2范数有界噪声。在l0-norm有界噪声的情况下，我们证明了迭代硬阈值（IHT）和基础追踪（BP）的恢复保证。对于ℓ2范数有界噪声，我们为BP提供恢复保证。理论上，这些保证支持[1]中引入的防御框架，用于防御神经网络对抗敌对输入。最后，我们通过IHT和BP对抗One Pixel Attack [21]，Carlini-Wagner l0和l2攻击[3]，Jacobian Saliency Based攻击[18]和DeepFool攻击[17]对CIFAR进行实验证明这个防御框架-10 [12]，MNIST [13]和Fashion-MNIST [27]数据集。这扩展到了实验演示之外。

原文标题：Recovery Guarantees for Compressible Signals with Adversarial Noise

原文摘要：We provide recovery guarantees for compressible signals that have been corrupted with noise and extend the framework introduced in [1] to defend neural networks against ℓ0-norm and ℓ2-norm attacks. Concretely, for a signal that is approximately sparse in some transform domain and has been perturbed with noise, we provide guarantees for accurately recovering the signal in the transform domain. We can then use the recovered signal to reconstruct the signal in its original domain while largely removing the noise. Our results are general as they can be directly applied to most unitary transforms used in practice and hold for both ℓ0-norm bounded noise and ℓ2-norm bounded noise. In the case of ℓ0-norm bounded noise, we prove recovery guarantees for Iterative Hard Thresholding (IHT) and Basis Pursuit (BP). For the case of ℓ2-norm bounded noise, we provide recovery guarantees for BP. These guarantees theoretically bolster the defense framework introduced in [1] for defending neural networks against adversarial inputs. Finally, we experimentally demonstrate this defense framework using both IHT and BP against the One Pixel Attack [21], Carlini-Wagner ℓ0 and ℓ2 attacks [3], Jacobian Saliency Based attack [18], and the DeepFool attack [17] on CIFAR-10 [12], MNIST [13], and Fashion-MNIST [27] datasets. This expands beyond the experimental demonstrations of.

地址：https://arxiv.org/abs/1907.06565