Understanding and Mitigating the Tradeoff Between Robustness and Accuracy

By Aditi Raghunathan, Sang Michael Xie, Fanny Yang, John C. Duchi, Percy Liang. 2020

256 citations recorded by the source corpus.

Adversarial training augments the training set with perturbations to improve the robust error (over worst-case perturbations), but it often leads to an increase in the standard error (on unperturbed test inputs). Previous explanations for this tradeoff rely on the assumption that no predictor in the hypothesis class has low standard and robust error. In this work, we precisely characterize the effect of augmentation on the standard error in linear regression when the optimal linear predictor has zero standard and robust error. In particular, we show that the standard error could increase even when the augmented perturbations have noiseless observations from the optimal linear predictor. We then prove that the recently proposed robust self-training (RST) estimator improves robust error without sacrificing standard error for noiseless linear regression. Empirically, for neural networks, we find that RST with different adversarial training methods improves both standard and robust error for random and adversarial rotations and adversarial $\ell_\infty$ perturbations in CIFAR-10.

Subfields: Artificial Intelligence, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Safety, Robustness & Interpretability

Citations in the corpus

Adversarial Training for Large Neural Language Models (2020, background): “Interestingly, some nascent results in reconciling the two also leverage unlabeled data, such as self-training (Raghunathan et al., 2020).”
Underspecification Presents Challenges for Credibility in Modern Machine Learning (2020, background): “Some recent work supports this observation: in the robustness literature Raghunathan et al. (2020) show that robustness / accuracy tradeoffs need not be fundamental, but are often driven by finite-sample phenomena; in the NLP literature, Webster et al. (2020) show that reliance on gendered…”
Adversarial Examples Improve Image Recognition (2019, background): “Other works try to explain this tradeoff phenomenon from the perspective of the increased sample complexity of adversary [37, 25, 28], the limited amount of training data [1, 27, 34, 44, 48], or network overparameterization [31].”
RobustBench: a standardized adversarial robustness benchmark (2020, methodology): “We also find that the use of 252 extra data is able to alleviate the robustness-accuracy trade-off as suggested in previous works [98].”
Calibrated ensembles can mitigate accuracy tradeoffs under distribution shift (2022, background): “Tradeoffs between ID and OOD accuracy are widely studied and prior work self-trains on large amounts of unlabeled data to mitigate such tradeoffs [Raghunathan et al., 2020, Xie et al., 2021, Khani and Liang, 2021].”
Geometry-aware Instance-reweighted Adversarial Training (2020, methodology): “On the other hand, some argued that there is no such the trade-off: Raghunathan et al. (2020) showed infinite data could eliminate this trade-off; Yang et al. (2020) showed benchmark image datasets are class-separated. ar X iv :2 01 0.”
In-N-Out: Pre-Training and Self-Training using Auxiliary Information for Out-of-Distribution Robustness (2020, background): “We assume we have n ≥ m + d in-distribution labeled training examples and unlimited access to unlabeled data both in-and out-of-distribution, a common assumption in unsupervised domain adaptation [43, 27, 35].”
Understanding Self-Training for Gradual Domain Adaptation (2020, background): “Recent work shows that a robust variant of self-training can mitigate the tradeoff between standard and adversarial accuracy (Raghunathan et al., 2020).”
On the Generalization Effects of Linear Transformations in Data Augmentation (2020, methodology): “To gain insight into the effects of linear transformations, we consider a conceptually simple over-parametrized model proposed in Bartlett et al. (2019); Xie et al. (2020); Hastie et al. (2019) that captures the need to add more data as in image settings.”
A Closer Look at Accuracy vs. Robustness (2020, methodology): “[42] proposes the robust self training method that aims to improve the robustness and accuracy tradeoff; however, our experiments show that they do not completely close the gap particularly when using only labeled data.”
Attacks Which Do Not Kill Training Make Adversarial Learning Stronger (2020, background): “, 2019), and providing a new explanation for the tradeoff between robustness and accuracy of PGD-adversarial training (Raghunathan et al., 2020).”
Do Wider Neural Networks Really Help Adversarial Robustness? (2020, background): “Works including [51] and [45] also challenged this robust-natural trade-off [61] does not hold for some cases.”
Fine-Tuning can Distort Pretrained Features and Underperform Out-of-Distribution (2022, unknown): “Tradeoffs between ID and OOD accuracy are widely studied and prior work self-trains on large amounts of unlabeled data to mitigate such tradeoffs (Raghunathan et al., 2020; Xie et al., 2021a; Khani & Liang, 2021).”