Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examples

By Sven Gowal, Chongli Qin, Jonathan Uesato, Timothy A. Mann, Pushmeet Kohli. arXiv.org, 2020

378 citations recorded by the source corpus.

Adversarial training and its variants have become de facto standards for learning robust deep neural networks. In this paper, we explore the landscape around adversarial training in a bid to uncover its limits. We systematically study the effect of different training losses, model sizes, activation functions, the addition of unlabeled data (through pseudo-labeling) and other factors on adversarial robustness. We discover that it is possible to train robust models that go well beyond state-of-the-art results by combining larger models, Swish/SiLU activations and model weight averaging. We demonstrate large improvements on CIFAR-10 and CIFAR-100 against $\ell_\infty$ and $\ell_2$ norm-bounded perturbations of size $8/255$ and $128/255$, respectively. In the setting with additional unlabeled data, we obtain an accuracy under attack of 65.88% against $\ell_\infty$ perturbations of size $8/255$ on CIFAR-10 (+6.35% with respect to prior art). Without additional data, we obtain an accuracy under attack of 57.20% (+3.46%). To test the generality of our findings and without any additional modifications, we obtain an accuracy under attack of 80.53% (+7.62%) against $\ell_2$ perturbations of size $128/255$ on CIFAR-10, and of 36.88% (+8.46%) against $\ell_\infty$ perturbations of size $8/255$ on CIFAR-100.

Subfields: Artificial Intelligence, Hardware and Architecture, Signal Processing

View Paper: https://www.semanticscholar.org/paper/1bcbf1efb3f81f0e777b4b754cf5b9789841d12f

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Hardware and Architecture

In Signal Processing

Citations in the corpus

Diffusion Models for Adversarial Purification (2022, background): “…(Wu et al., 2020) 85.36 59.18 (Rebufﬁ et al., 2021) 87.33 61.72 (Gowal et al., 2021) 87.50 65.24 Ours 89.02 ± 0.21 70.64 ± 0.39 WideResNet-70-16 (Gowaletal.,2020) 91.10 66.02 (Rebufﬁ et al., 2021) 92.23 68.56 (Gowal et al., 2020) 85.29 59.57 (Rebufﬁ et al., 2021) 88.54 64.46 (Gowal et al.,…”
Improving Robustness using Generated Data (2021, methodology): “For adversarial training, we use TRADES [83] with 10 Projected Gradient Descent (PGD) steps.”
Fixing Data Augmentation to Improve Adversarial Robustness (2021, methodology): “• To the contrary of Rice et al. (2020); Wu et al. (2020); Gowal et al. (2020) which all tried data augmentation techniques without success, we are able to use any of these three aforementioned techniques to obtain new state-of-the-art robust accuracies.”
Data Augmentation Can Improve Robustness (2021, methodology): “Notably, Carmon et al. [7], Hendrycks et al. [25], Najaﬁ et al. [35], Uesato et al. [53], Zhai et al. [59] showed that using additional data improves adversarial robustness, while Gowal et al. [20], Rice et al. [43], Wu et al. [55] found that data augmentation techniques did not boost robustness.”
Better Diffusion Models Further Improve Adversarial Training (2023, methodology): “Following the similar guidelines in Gowal et al. (2020) and Pang et al. (2021), we examine the effects of, e.g., quantity and quality of generated data, early stopping, and data augmentation.”
Cross-Entropy Loss Functions: Theoretical Analysis and Applications (2023, methodology): “We averaged accuracies over three runs and report the standard deviation for both ADV-COMP-SUM and TRADES, reproducing the results reported for TRADES in (Gowal et al., 2020).”
RobustBench: a standardized adversarial robustness benchmark (2020, background): “Thus one can expect lower privacy leakage in robust networks as 330 multiple previous works have explicitly aimed to reduce the generalization gap in robust training using 331 techniques such as early stopping [102, 152, 46].”
Do Wider Neural Networks Really Help Adversarial Robustness? (2020, methodology): “[24] achieves further robust models by practical techniques like weight averaging.”
Relating Adversarially Robust Generalization to Flat Minima (2021, background): “Similarly, [18] shows that weight averaging [26] can improve robust generalization, indicating that flatness might be beneficial in general.”