基于 Fisher 几何的置信度结构扰动对抗训练方法
Structured Confidence Perturbation via Fisher Geometry for Adversarial Training
对抗训练领域的老问题：很多攻击只是推高 loss，模型置信度其实没被真正扰动。这篇论文从 Fisher 信息矩阵几何角度重做了扰动生成，理论给得清楚，算法避开了高维矩阵计算。做鲁棒性研究的同学可以直接看实验部分和伪代码。
一篇 arXiv 论文（arXiv:2611.14046）针对对抗训练中的“伪攻击”问题提出新方案——伪攻击指扰动显著提升 loss 值却未能真正改变模型置信度结构的攻击。
作者提出两条互补路线：一是将交叉熵与 KL 散度结合成混合目标函数，让对抗样本同时破坏预测准确率和输出分布一致性；二是在置信度流形上生成最大化分布距离的扰动。
理论分析证明最优扰动方向与 Fisher 信息矩阵的主特征向量对齐，并给出避免高维矩阵运算的高效算法。在多个数据集和模型架构上的实验显示，该方法在对抗鲁棒性和鲁棒可迁移性上超过现有方法，尤其在高置信区域的结构性扰动上表现突出。
Structured Confidence Perturbation via Fisher Geometry for Adversarial Training
Adversarial training is often plagued by "pseudo-attacks", perturbations that significantly increase the loss value but fail to truly alter the model's confidence structure. To address this, we propose two complementary approaches to directly attack and defend against confidence structure deformation. First, building upon the traditional loss maximization perspective, we introduce a hybrid objective that integrates cross-entropy and KL divergence, encouraging adversarial examples to simultaneously disrupt prediction accuracy and distribution consistency. Second, we geometrically reconstruct adversarial training by generating perturbations that maximize the distribution distance on the confidence manifold. Theoretical analysis shows that the optimal perturbation direction aligns with the principal eigenvectors of the Fisher information matrix. We also propose an efficient algorithm to avoid high-dimensional matrix computations. Experiments on multiple datasets and model architectures demonstrate that our method outperforms existing methods in adversarial robustness and robust transferability, particularly excelling in structural perturbations within high-confidence regions.
本条情报归属 AITOP「论文」核心追踪栏目。涉及核心实体与技术议题包括：对抗训练、Fisher信息矩阵、鲁棒性、KL散度，读者可通过下方标签进入对应专题页查阅历史脉络与关联对比。
信源核验说明：本文原始线索采编自「arXiv cs.LG」（@Chenlong Wei, Hanling Wang, Chong Zhang, Qinkai Yu, Fangyu Wu, Xiaobo Jin），经 AITOP 多维评分管线结构化提炼。