Ian J. Goodfellow, Jonathon Shlens & Christian Szegedy
ICLR 2015

## 为什么会产生对抗样本？

1. Box-constrained L-BFGS can reliably ﬁnd adversarial examples.

2. On some datasets, such as ImageNet (Deng et al., 2009), the adversarial examples were so close to the original examples that the differences were indistinguishable to the human eye.

3. The same adversarial example is often misclassiﬁed by avariety of classiﬁers with different architectures or trained on different subsets of the training data.

4. Shallow softmax regression models are also vulnerable to adversarial examples.

5. Training on adversarial examples can regularize the model —however , this was not practical at the time due to the need for expensive constrained optimization in the inner loop

## 对抗样本的线性解释

$\hat{x} = x+\eta$ ，若$||\eta||_\infty<\epsilon$，分类器将无法将$x$与$\hat{x}$分开

## 线性模型的对抗训练

$P(y=1|x)=\sigma(w^Tx+b),\sigma(z)=softmax(z)$

$\therefore J = E{x,y \tilde{} p_{data}}[(-\frac{1+y}{2})\ln P(y=1|x)-\frac{1-y}{2}\ln P(y=-1|x)]$

$\therefore J=-\frac{1}{2}\ln p-\frac{y}{2}\ln p-\frac{1}{2}\ln (1-p)+\frac{y}{2}\ln (1-p)$

$=-\frac{1}{2}\ln p（1-p)-\frac{y}{2}\ln \frac{p}{1-p}$

$= \frac{1}{2}(f-yf) + \ln(1+e^{-f})$

$=\begin{cases} \ln(1+e^{-f}),y=1\\ f+\ln(1+e^{-f})=\ln e^f+\ln(1+e^{-f})=\ln(1+e^f),y=-1\end{cases}$

$= \ln(1+e^{-yf})$

$=\zeta(-yf)=E{x,y \tilde{} p_{data}}\zeta(-y(w^Tx+b)),\zeta(z) = \ln(1+e^z)$

$\therefore \eta=\epsilon sign(\nabla_xJ(\theta,x,y))$

$=\epsilon sign(\nabla_x\zeta(-y(w^Tx+b)))$

$= \epsilon sign(\frac{\partial \ln(1+e^{-y(w^Tx+b)})}{\partial x})$

$=\epsilon sign(\frac{1}{1+e^{-y(w^Tx+b)}} ×(-e^{-y(w^Tx+b)})×(yw^T))$

$=\epsilon sign(\frac{e^{-yf}}{1+e^{-yf}}×(-y)w)$

$=\epsilon sign(-w)=-\epsilon sign(w)$

$\because w^Tsign(w)=||w||_1，\hat{x}=x+\eta,\eta=\epsilon-sign(w)$

$\therefore \hat{J}=E{x,y \tilde{} p_{data}}\zeta(y(\epsilon||w||_1 -w^Tx-b))$