Enhancing adversarial defense robustness through sensitive prediction region mining

Abstract

Current adversarial defense methods often rely on specific perturbation generation techniques, which face challenges such as limited generalization performance and high computational costs. This paper addresses these issues by examining the response characteristics of intelligent learning models to sensitive adversarial samples in white-box attack scenarios. By analyzing the model's sensitivity in response to adversarial samples, we explore the underlying mechanisms that enhance model robustness. Specifically, we examine the decision boundaries of sensitive adversarial samples and investigate the differences in decision-making between sensitive and normal samples within the model’s classification process. Additionally, we introduce a robust feature extraction mechanism based on the stability of sensitive samples. This mechanism analyzes prediction consistency in the local linear regions of samples, enabling more effective identification of regions critical to model robustness. We further design a robust training frame work that incorporates sensitive sample mining, optimizing adversarial sample prediction ambiguity regions to control the model’s responses in decision boundaries. This framework establishes an interpretable connection between the generation of sensitive adversarial samples and the model's decision boundaries, enhancing robustness while maintaining generalization performance. Our approach offers a comprehensive solution to the challenges of adversarial defense, providing insights into model behavior and adversarial sample handling, and lays the foundation for more robust, interpretable, and efficient adversarial defense mechanisms.