The study of adversarial examples in deep neural networks has attracted great attention. Numerous methods improve adversarial robustness via shrinking the gap of features between natural examples and adversarial examples. Nevertheless, the role of individual features in adversarial robustness has not been explored adequately. In this paper, we delve into this problem from the perspective of spectral analysis in feature space. We find that while standardly trained deep models have features distributed dominantly along eigenvectors with large eigenvalues, eigenvectors with smaller eigenvalues are more sensitive to adversarial attacks. We attribute this phenomenon to the dominance of the top eigenvalues, linked to the concept of intrinsic dimensionality. The extracted features possess a small intrinsic dimensionality, enhancing generalization but resulting in the model overlooking diverse features. We propose a method called Feature Spectral Regularization (FSR) to penalize the largest eigenvalue, so as to spread the distribution of eigenvalues. Comprehensive experiments demonstrate that FSR is effective to alleviate the dominance of larger eigenvalues, increase the intrinsic dimensionality, and improve adversarial robustness on multiple datasets.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Delving into Feature Space: Improving Adversarial Robustness by Feature Spectral Regularization

  • Zhen Cheng,
  • Fei Zhu,
  • Xu-Yao Zhang,
  • Cheng-Lin Liu

摘要

The study of adversarial examples in deep neural networks has attracted great attention. Numerous methods improve adversarial robustness via shrinking the gap of features between natural examples and adversarial examples. Nevertheless, the role of individual features in adversarial robustness has not been explored adequately. In this paper, we delve into this problem from the perspective of spectral analysis in feature space. We find that while standardly trained deep models have features distributed dominantly along eigenvectors with large eigenvalues, eigenvectors with smaller eigenvalues are more sensitive to adversarial attacks. We attribute this phenomenon to the dominance of the top eigenvalues, linked to the concept of intrinsic dimensionality. The extracted features possess a small intrinsic dimensionality, enhancing generalization but resulting in the model overlooking diverse features. We propose a method called Feature Spectral Regularization (FSR) to penalize the largest eigenvalue, so as to spread the distribution of eigenvalues. Comprehensive experiments demonstrate that FSR is effective to alleviate the dominance of larger eigenvalues, increase the intrinsic dimensionality, and improve adversarial robustness on multiple datasets.