Relating Adversarially Robust Generalization to Flat Minima

By David Stutz, Matthias Hein, Bernt Schiele. 2021

80 citations recorded by the source corpus.

Adversarial training (AT) has become the de-facto standard to obtain models robust against adversarial examples. However, AT exhibits severe robust overfitting: cross-entropy loss on adversarial examples, so-called robust loss, decreases continuously on training examples, while eventually increasing on test examples. In practice, this leads to poor robust generalization, i.e., adversarial robustness does not generalize well to new examples. In this paper, we study the relationship between robust generalization and flatness of the robust loss landscape in weight space, i.e., whether robust loss changes significantly when perturbing weights. To this end, we propose average- and worst-case metrics to measure flatness in the robust loss landscape and show a correlation between good robust generalization and flatness. For example, throughout training, flatness reduces significantly during overfitting such that early stopping effectively finds flatter minima in the robust loss landscape. Similarly, AT variants achieving higher adversarial robustness also correspond to flatter minima. This holds for many popular choices, e.g., AT-AWP, TRADES, MART, AT with self-supervision or additional unlabeled examples, as well as simple regularization techniques, e.g., AutoAugment, weight decay or label noise. For fair comparison across these approaches, our flatness measures are specifically designed to be scale-invariant and we conduct extensive experiments to validate our findings.

Subfields: Artificial Intelligence, Electrical and Electronic Engineering

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Electrical and Electronic Engineering

Citations in the corpus

On the Effectiveness of Lipschitz-Driven Rehearsal in Continual Learning (2022, neutral): “In this respect, the bridge between the two objectives is worth-exploring and still open to debate [83, 71, 87, 36].”
RobustBench: a standardized adversarial robustness benchmark (2020, methodology): “We remark that recent works have already referred to our leaderboards [74, 163, 89, 136, 159], in particular as reflecting the current state of the art [111, 83, 103], and used the networks of our Model Zoo to test new adversarial attacks [92, 115, 41, 119], evaluate test-time defenses [146] or perc”