Adversarial Robustness Analysis of Attention Modules in Deep Neural Networks

Abstract

The attention mechanism is derived from the study of human vision, which improves the accuracy of the model by increasing the weight of the noteworthy parts, and the existing attention is channel attention, spatial attention, and hybrid models. The development of attention in improving the accuracy of the model is sufficient, but under the influence of adversarial attacks, the influence of attention on the adversarial robustness of the model has not been fully studied. The purpose of this paper is to explore the effect of attention on model robustness. In this paper, the commonly used attention SENet, CBAM, ECAnet, SGE, SKNet, etc. are combined with the commonly used classification model ResNet to train the weights of the model from scratch, and compare the robustness of the combined model against confrontation. In addition, the influence of attention on ordinary noise is also reflected by comparison with Gaussian and salt and pepper noise. Based on the robustness formula of the predecessors, this paper proposes an adversarial robustness formula to uniformly evaluate the adversarial samples with different disturbance parameters of different networks. It is proved that the structure of attention has an impact on the robustness of the model, and SKNet, SGE, and CBAM will improve the robustness of the model in the 18-layer model, with the deepening of the model, attention has a negative improvement on the robustness of the model. Attention has a good robustness to Gaussian and salt and pepper noise, but also reflects a negative improvement with the deepening of the network.