Artificial Neural Networks (ANNs) trained with Backpropagation (BP) show astounding performance and are increasingly often used in performing our daily life tasks. However, ANNs are highly vulnerable to adversarial attacks, which alter inputs with small targeted perturbations that drastically disrupt the models' performance. The most effective method to make ANNs robust against these attacks is adversarial training, in which the training dataset is augmented with exemplary adversarial samples. Unfortunately, this approach has the drawback of increased training complexity since generating adversarial samples is very computationally demanding. In contrast to ANNs, humans are not susceptible to adversarial attacks. Therefore, in this work, we investigate whether biologically-plausible learning algorithms are more robust against adversarial attacks than BP. In particular, we present an extensive comparative analysis of the adversarial robustness of BP and Present the Error to Perturb the Input To modulate Activity (PEPITA), a recently proposed biologically-plausible learning algorithm, on various computer vision tasks. We observe that PEPITA has higher intrinsic adversarial robustness and, with adversarial training, has a more favourable natural-vs-adversarial performance trade-off as, for the same natural accuracies, PEPITA's adversarial accuracies decrease in average by 0.26% and BP's by 8.05%.

翻译：通过反向传播（BP）训练的人工神经网络（ANN）展现出惊人性能，并日益广泛地应用于日常任务中。然而，ANN极易受到对抗攻击——通过向输入添加微小目标扰动来严重破坏模型性能。使ANN具备对抗鲁棒性的最有效方法是对抗训练，即在训练数据集中增强具有代表性的对抗样本。遗憾的是，该方法存在训练复杂度增加的缺陷，因为生成对抗样本需要极高的计算成本。与ANN不同，人类对对抗攻击具有天然抵抗力。因此，本研究探究生物可解释学习算法是否比BP具有更强的对抗鲁棒性。具体而言，我们在多种计算机视觉任务上，对BP与近期提出的生物可解释学习算法PEPITA（通过将误差扰动输入以调制活动）进行了对抗鲁棒性的全面比较分析。实验表明，PEPITA具有更高的内在对抗鲁棒性，且经过对抗训练后，其自然性能与对抗性能的权衡更为优越：在相同的自然准确率下，PEPITA的对抗准确率平均仅下降0.26%，而BP则下降8.05%。