做网络安全和ML-NIDS的团队，不用加额外防御就能提升模型抗攻击能力——调整架构本身就能见效，值得在现有系统上试试这个“少即是多”的思路。
本文研究了在基于梯度的对抗攻击下，仅通过精心选择网络架构（如更浅的网络、更少的特征和ReLU激活函数）能否使基于深度神经网络的入侵检测系统（NIDS）具备内在鲁棒性。通过约2200次实验，对比FGSM、PGD和BIM攻击，发现浅层网络、简化特征集和ReLU激活函数能显著降低对抗脆弱性。这种简单模型甚至优于经过对抗训练的深层全特征模型，同时保持近乎完美的正常流量检测率和更短的训练时间。研究强调，关键在于选择“正确的少”而非盲目简化。
A No-Defense Defense Against Gradient-Based Adversarial Attacks on ML-NIDS: Is Less More?
Gradient-based adversarial attacks subtly manipulate inputs of Machine Learning (ML) models to induce incorrect predictions. This paper investigates whether careful architectural choices alone can yield an inherently robust Deep Neural Network (DNN)-based Network Intrusion Detection Systems (NIDS), without any additional explicit defenses. Through thousands of experiments, around 2200, varying network depth, feature dimensionality, activation functions, and dropout across FGSM, PGD, and BIM attacks, we show that shallower networks, reduced feature sets, and ReLU activation consistently and jointly reduce adversarial vulnerability. Moreover, a simple model following this recipe outperforms deeper, fully-featured adversarially trained models, while maintaining near-perfect clean-traffic detection and lower training times. Nevertheless, while less is more, the selection of the right less is what truly matters.