Abstract:Deep State Space Models (SSMs) have proven effective in numerous task scenarios but face significant security challenges due to Adversarial Perturbations (APs) in real-world deployments. Adversarial Training (AT) is a mainstream approach to enhancing Adversarial Robustness (AR) and has been validated on various traditional DNN architectures. However, its effectiveness in improving the AR of SSMs remains unclear. While many enhancements in SSM components, such as integrating Attention mechanisms and expanding to data-dependent SSM parameterizations, have brought significant gains in Standard Training (ST) settings, their potential benefits in AT remain unexplored. To investigate this, we evaluate existing structural variants of SSMs with AT to assess their AR performance. We observe that pure SSM structures struggle to benefit from AT, whereas incorporating Attention yields a markedly better trade-off between robustness and generalization for SSMs in AT compared to other components. Nonetheless, the integration of Attention also leads to Robust Overfitting (RO) issues. To understand these phenomena, we empirically and theoretically analyze the output error of SSMs under AP. We find that fixed-parameterized SSMs have output error bounds strictly related to their parameters, limiting their AT benefits, while input-dependent SSMs may face the problem of error explosion. Furthermore, we show that the Attention component effectively scales the output error of SSMs during training, enabling them to benefit more from AT, but at the cost of introducing RO due to its high model complexity. Inspired by this, we propose a simple and effective Adaptive Scaling (AdS) mechanism that brings AT performance close to Attention-integrated SSMs without introducing the issue of RO. Our code is available at <a class="link-external link-https" href="https://github.com/Biqing-Qi/Exploring-Adversarial-Robustness-of-Deep-State-Space-Models.git" rel="external noopener nofollow">this https URL</a>.

What problem does this paper attempt to address?

The core problem that this paper attempts to solve is the security challenges brought by adversarial perturbations (APs) faced by deep state space models (SSMs) in actual deployment. Specifically, the paper focuses on the following aspects: 1. **The improvement effect of adversarial training (AT) on SSMs**: Although adversarial training has been verified to effectively improve the adversarial robustness (AR) of traditional deep neural networks (DNNs), its effectiveness in SSMs has not been clear. Therefore, the paper aims to evaluate the AR performance of existing SSM structures and their variants under adversarial training. 2. **The influence of different components on the robustness and generalization ability of SSMs**: Many designs for enhancing SSM performance (such as introducing the attention mechanism and expanding to data - dependent parameterization) perform well in standard training (ST), but it is not clear whether they are equally effective under adversarial training. In addition, how these designs affect the trade - off between robustness and generalization is also an important issue. 3. **Explore more robust SSM structure designs**: By analyzing the performance of different components in adversarial training, the paper hopes to provide valuable insights for designing more robust SSM structures. ### Main research questions 1. **Can existing component designs improve the performance of SSMs in adversarial training?** - Since adversarial attacks induce mispredictions through carefully designed small perturbations, they may have a more significant negative impact on SSMs that rely on sequence dependence. Therefore, whether common adversarial training frameworks (such as PGD - AT and TRADES) can effectively improve the adversarial robustness of SSMs is a problem that needs to be explored. 2. **How do different components affect the robustness - generalization trade - off in adversarial training?** - There is a trade - off between robustness and generalization. Adversarial training usually leads to a decrease in the accuracy of the model on clean data, thus affecting the generalization ability. In addition, deep learning models are prone to robust overfitting (RO), that is, the model overfits on adversarial training samples but performs poorly on adversarial test samples. The paper explores how different SSM structures (such as diagonalized and multi - input multi - output (MIMO) SSM) affect this trade - off. 3. **Can the performance of different components in adversarial training provide inspiration for more robust SSM structure design?** - The paper analyzes the behavior of components of different SSM variants in adversarial training to identify those components that are helpful for improving robustness and provide guidance for improving the robustness and performance of SSMs. ### Experimental results Through experiments, the paper has obtained the following main observations: 1. **Pure SSM structures are difficult to benefit from adversarial training**: Pure SSM structures show obvious robustness - generalization trade - off problems after adversarial training, and data - dependent parameterization does not significantly improve this situation. 2. **Introducing the attention mechanism significantly improves robustness and clean accuracy, but also introduces a serious robust overfitting problem**. 3. **Pure SSM structures perform poorly in adversarial training, and data - dependent parameterization does not significantly improve this situation**. Based on these findings, the paper further explores the limitations of the internal characteristics of SSMs on their adversarial training effects, and whether the attention mechanism itself causes overfitting, etc., and proposes a simple adaptive scaling (AdS) mechanism to improve the adversarial robustness of SSMs while avoiding overfitting problems. ### Summary Through theoretical analysis and experimental verification, this paper reveals the performance of different SSM components in adversarial training and proposes a method to improve the adversarial robustness of SSMs, providing a valuable reference for future research.

Exploring Adversarial Robustness of Deep State Space Models

Attack As Defense: Characterizing Adversarial Examples Using Robustness.

Boosting Adversarial Training in Safety-Critical Systems Through Boundary Data Selection

Strength-Adaptive Adversarial Training

Enhancing Adversarial Robustness through Stable Adversarial Training

Theoretical Foundations of Deep Selective State-Space Models

Robust Deep Reinforcement Learning against Adversarial Perturbations on State Observations

Exploring Architectural Ingredients of Adversarially Robust Deep Neural Networks

Exploring Robustness of Visual State Space model against Backdoor Attacks

Adversarial Training: A Survey

On Adversarial Robustness of 3D Point Cloud Classification under Adaptive Attacks

A2: Efficient Automated Attacker for Boosting Adversarial Training

Improving Out-of-Distribution Generalization by Adversarial Training with Structured Priors

Towards Robustness of Text-to-SQL Models Against Natural and Realistic Adversarial Table Perturbation.

Scattering Model Guided Adversarial Examples for SAR Target Recognition: Attack and Defense

Robust Deep Reinforcement Learning with Adaptive Adversarial Perturbations in Action Space

State Space Model for New-Generation Network Alternative to Transformers: A Survey

On the Duality Between Sharpness-Aware Minimization and Adversarial Training

Layer-Adaptive State Pruning for Deep State Space Models

Improving Adversarial Robustness via Attention and Adversarial Logit Pairing

Sparta: Spatially Attentive and Adversarially Robust Activation