{
  "schema": "auturnal.deep-research-review.v1",
  "slug": "robustness-adversarial",
  "title": "对抗鲁棒性的可检验边界：威胁模型、范数预算与攻击验收",
  "category": "可信AI与方法论",
  "dek": "用线性模型说明高维扰动为何可能累积，再区分攻击失败与鲁棒性证据。",
  "english": "Adversarial robustness is defined relative to a threat model, perturbation set and evaluation procedure. We derive the exact worst-case linear perturbation under an infinity-norm budget and contrast it with a two-norm constraint. Analytical dimension curves are not attack success rates. Adaptive evaluation and clean-robust tradeoffs remain empirical requirements.",
  "kind": "ai_assisted_research_guide",
  "author": "Codex（AI）",
  "original_language": "zh-Hans",
  "published_date": "2026-10-22",
  "edition": 5,
  "version": 6,
  "previous_version": "/guides/robustness-adversarial/v5/",
  "refs": [
    "arxiv-1412.6572",
    "arxiv-1706.06083",
    "arxiv-1901.08573"
  ],
  "sections": [
    [
      "摘要",
      "鲁棒性不是一个脱离条件的模型属性，而是针对攻击者能力、扰动集合和任务定义的有限结论。本文推导线性模型在无穷范数预算下的最坏扰动，分析高维累积和范数区别，再讨论对抗训练、自然准确率折中与梯度遮蔽。图示是解析敏感度，不是针对真实服务的攻击或准确率测量。",
      [
        "arxiv-1412.6572",
        "arxiv-1706.06083",
        "arxiv-1901.08573"
      ]
    ],
    [
      "1. 威胁模型必须先于攻击结果",
      "应说明攻击者知道什么、能改哪些输入、改动大小、查询预算和成功标准。图像中的小范数扰动、自然分布变化和语义改写是不同威胁，不能互相替代。若攻击约束与真实用途无关，即使测试很严格也可能回答错问题。本文讨论公开方法的数学与防御验收，不对任何第三方服务实施攻击。",
      [
        "arxiv-1412.6572",
        "arxiv-1706.06083"
      ]
    ],
    [
      "2. 线性累积揭示高维敏感度",
      "对线性得分w转置x，无穷范数不超过ε的扰动可令每个坐标沿w符号变化，最大得分变化为ε乘w的一范数。若w的二范数固定为1且均匀分布到d维，该量为ε√d；二范数预算下的最大变化则为ε。图中只展示这个确定性关系，不代表神经网络必然按同样速率失败，也不代表不同范数预算具有相同感知强度。",
      [
        "arxiv-1412.6572"
      ]
    ],
    [
      "3. 对抗训练是嵌套优化而非通用免疫",
      "鲁棒优化在允许扰动集合中寻找较坏输入，再更新模型降低损失。内层搜索通常只是近似，步数、初始化和约束投影都会影响训练与验收。训练攻击与测试攻击相同，可能造成对特定搜索方式的过拟合。应固定威胁集合，使用独立更强或自适应的评估，并报告计算预算。即便某范数下结果改善，也不能宣称对所有自然变化或语义威胁鲁棒。",
      [
        "arxiv-1706.06083"
      ]
    ],
    [
      "4. 攻击失败不等于证明安全",
      "梯度不稳定、随机化、不可微预处理或数值截断，可能让一个攻击器找不到失败，却没有消除失败输入。需要多起点、不同步数和适合防御结构的自适应检查，并核对增加预算时结果是否合理。白盒与黑盒结果反常、单步强于多步等现象应触发复核。认证界限与经验攻击结果属于不同证据，不能混称。",
      [
        "arxiv-1706.06083",
        "arxiv-1412.6572"
      ]
    ],
    [
      "5. 自然准确率与鲁棒准确率要联合报告",
      "TRADES研究自然误差与鲁棒误差之间的关系，并提出相应训练目标。实际折中依赖数据、模型、扰动和训练方式；不能据此宣称所有方案存在同一个固定损失比例。报告应画出不同超参数下的联合曲线，保留自然样本、难例和子群，避免只挑一个最好鲁棒数字而隐藏正常使用退化。",
      [
        "arxiv-1901.08573"
      ]
    ],
    [
      "6. 可靠验收需要可重复失败与范围声明",
      "冻结模型、预处理、威胁预算与成功定义，保存每个受控测试样本的结果及合法可展示扰动。先在小模型上核对攻击实现，再对目标模型多次运行。最终结论限定到测过的集合、预算和数据，并列出尚未覆盖的自然或语义变化。本文没有进行真实攻击、训练或认证，只提供线性推导与验收框架。",
      [
        "arxiv-1412.6572",
        "arxiv-1706.06083",
        "arxiv-1901.08573"
      ]
    ]
  ],
  "equations": [
    {
      "tex": "\\max_{\\|\\delta\\|_\\infty\\le\\epsilon}w^\\top\\delta=\\epsilon\\|w\\|_1",
      "explanation": "线性函数的精确结果，最优扰动沿w逐坐标符号；不是一般网络全局误差公式。"
    },
    {
      "tex": "\\delta_{\\mathrm{FGSM}}=\\epsilon\\operatorname{sign}(\\nabla_x\\mathcal L)",
      "explanation": "损失局部线性化下的单步方向，实际测试还需约束和有效输入范围处理。"
    },
    {
      "tex": "\\min_\\theta\\mathbb E_{(x,y)}\\max_{\\delta\\in S}\\mathcal L(f_\\theta(x+\\delta),y)",
      "explanation": "鲁棒优化目标；内层数值搜索不自动得到全局最大值。"
    }
  ],
  "table": {
    "headers": [
      "方法或判断",
      "控制变量与测量",
      "失效条件及解释"
    ],
    "rows": [
      [
        "范数威胁",
        "固定范数、ε和有效输入范围",
        "不同范数不是相同攻击能力"
      ],
      [
        "经验攻击",
        "多起点和自适应预算",
        "找不到反例不证明不存在"
      ],
      [
        "对抗训练",
        "独立攻击及自然数据回归",
        "训练威胁不覆盖所有变化"
      ],
      [
        "鲁棒报告",
        "质量、成本与适用范围联合",
        "单一成功率无法代表普遍安全"
      ]
    ]
  },
  "protocol": [
    "明确授权测试范围、威胁集合、查询预算和成功标准。",
    "冻结模型、预处理与随机性，先核对小模型解析结果。",
    "使用多起点、多预算和适配防御结构的独立评估。",
    "检查预算单调性、梯度与数值异常，排除遮蔽造成的假象。",
    "同时报告自然准确率、鲁棒指标、子群与计算成本。",
    "保存可重复失败及范围声明，不外推未测威胁或宣称通用安全。"
  ],
  "diagram": [
    "任务及威胁定义",
    "范数 / 预算 / 输入域",
    "局部扰动与搜索",
    "鲁棒训练或防御",
    "独立自适应验收",
    "自然质量与范围声明"
  ],
  "analytic": "adversarial-dimension",
  "limitations": [
    "线性敏感度不是网络攻击成功率。",
    "没有对真实服务实施攻击。",
    "经验攻击不能替代认证。",
    "结论必须限定威胁集合。"
  ],
  "keywords": [
    "adversarial-robustness",
    "threat-model",
    "evaluation"
  ],
  "peer_reviewed": false,
  "journal_publication": false,
  "disclosure": {
    "authorship": "AI辅助研究综述；Codex（AI）依据所列一手文献撰写并进行解析推导。",
    "figures": "概念封面与科学图解分开；科学图由公开公式和明示假设计算，原始论文结果均注明归属。",
    "review": "本站没有本篇独立同行评审或原创模型实验记录。"
  },
  "section_kinds": [
    "source_based_review",
    "source_based_review",
    "source_based_review",
    "source_based_review",
    "source_based_review",
    "source_based_review",
    "source_based_review"
  ],
  "revision_note": "阅读器性能修订：新近 HEAD 返回 200 且 ETag 相同时也复用已读页面。正文、公式、来源和科学图的数据保持上一版本内容。",
  "sources": [
    {
      "id": "arxiv-1412.6572",
      "title": "Explaining and Harnessing Adversarial Examples",
      "authors": ",  ,",
      "url": "https://arxiv.org/abs/1412.6572",
      "date": "2014-12-20",
      "accessed_at": "2026-10-21",
      "locator": "Abstract; 原文方法、理论和实验章节见作者原始论文链接",
      "note": "一手论文；原文研究归属原作者。本文的推导示例与建议实验方案另行标注，不冒充原论文或本站实测。"
    },
    {
      "id": "arxiv-1706.06083",
      "title": "Towards Deep Learning Models Resistant to Adversarial Attacks",
      "authors": ",  ,  ,  ,",
      "url": "https://arxiv.org/abs/1706.06083",
      "date": "2017-06-19",
      "accessed_at": "2026-10-21",
      "locator": "Abstract; 原文方法、理论和实验章节见作者原始论文链接",
      "note": "一手论文；原文研究归属原作者。本文的推导示例与建议实验方案另行标注，不冒充原论文或本站实测。"
    },
    {
      "id": "arxiv-1901.08573",
      "title": "Theoretically Principled Trade-off between Robustness and Accuracy",
      "authors": ",  ,  ,  ,  ,",
      "url": "https://arxiv.org/abs/1901.08573",
      "date": "2019-01-24",
      "accessed_at": "2026-10-21",
      "locator": "Abstract; 原文方法、理论和实验章节见作者原始论文链接",
      "note": "一手论文；原文研究归属原作者。本文的推导示例与建议实验方案另行标注，不冒充原论文或本站实测。"
    }
  ],
  "figures": {
    "mechanism": {
      "url": "/guides/assets/v5-mechanism-robustness-adversarial-e82d3733f8813718.png",
      "kind": "conceptual_method_flow",
      "data": [
        "任务及威胁定义",
        "范数 / 预算 / 输入域",
        "局部扰动与搜索",
        "鲁棒训练或防御",
        "独立自适应验收",
        "自然质量与范围声明"
      ]
    },
    "analysis": {
      "url": "/guides/assets/v5-analysis-robustness-adversarial-3fbcbbe118639fb7.png",
      "kind": "analytical_or_constructed_example",
      "data_url": "/guides/assets/v5-data-robustness-adversarial-918669ef6e2245bc.json",
      "assumptions": "w=ones/sqrt(d), ||w||2=1, epsilon0.05 for each distinct norm constraint. Not equal perceptual strength or attack success."
    }
  },
  "cover_provenance_url": "/guides/assets/v5-provenance-robustness-adversarial-4c6fa0f6abb8adca.json",
  "source_revision": "6251a250b27bb8b449f59b392f81abd355383770",
  "pdf": {
    "document_id": "ccc69248-c275-50c3-88ce-7aa5983ccec6",
    "version_id": "eeb61446-c6c1-51eb-8d19-f737c113f3ee",
    "media_type": "application/pdf",
    "authentication_required": true,
    "download_audited": true
  },
  "presentation_change": "Complete version-bound translated reading views and selectable authenticated original/translated PDFs; original scientific text and evidence retained.",
  "source_locale": "zh",
  "source_version_id": "4021683e-02e4-54e6-8595-21690a64f074",
  "translations": [
    {
      "locale": "en",
      "translation_id": "307b052c-922c-53d5-9fb4-ae5a7d4eb74b",
      "translated_content_sha256": "42f8c8f9c860d884234bee77636e1032d42ae59b886b2de100ae7e9d630387e9",
      "sha256": "1e1d63fc207fdc1c26df24485ab7b2fb0acb77375a8b93609878181267810f56",
      "byte_length": 657801
    },
    {
      "locale": "es",
      "translation_id": "c92a19d7-abc2-5d69-a723-5356d09cf89b",
      "translated_content_sha256": "02bb6486f3a0b7facca1a9eaab392aced8033a618fb4bebd7a35936bcfdc186c",
      "sha256": "70ad8cdeb6331bafb63ba783435eb9cd95bb0593c82b8f11b32cd61e1d5ab503",
      "byte_length": 662034
    },
    {
      "locale": "ja",
      "translation_id": "c0908877-a1a3-5e48-ae6d-f93f83802964",
      "translated_content_sha256": "b0bad0bb2e3ebe6b9660786cea0e34a04c795a3b3ee5c7c8d7f6913b6714cb2d",
      "sha256": "b1f4e7c5a6a66c9f12bd16587b1e9251b70fe4a40a1e5dd31d2c1109494ea347",
      "byte_length": 787787
    },
    {
      "locale": "ar",
      "translation_id": "3ef1dc2c-79f3-594c-ac78-ec0cf8431aa6",
      "translated_content_sha256": "96786ff2984e3b4b6a84917a0a0f277c5287caefcfa3842379ede134cd9a5490",
      "sha256": "e892ce09be8b83ea6e1e9aa5abf8dca940006afb11943ce5775123f80ebb500d",
      "byte_length": 643507
    }
  ]
}