Adversarially Robust Generalization Just Requires More Unlabeled Data

By Runtian Zhai, Tianle Cai, Di He, Chen Dan, Kun He, John E. Hopcroft, Liwei Wang. 2019

161 citations recorded by the source corpus.

Neural network robustness has recently been highlighted by the existence of adversarial examples. Many previous works show that the learned networks do not perform well on perturbed test data, and significantly more labeled data is required to achieve adversarially robust generalization. In this paper, we theoretically and empirically show that with just more unlabeled data, we can learn a model with better adversarially robust generalization. The key insight of our results is based on a risk decomposition theorem, in which the expected robust risk is separated into two parts: the stability part which measures the prediction stability in the presence of perturbations, and the accuracy part which evaluates the standard classification accuracy. As the stability part does not depend on any label information, we can optimize this part using unlabeled data. We further prove that for a specific Gaussian mixture problem illustrated by [35], adversarially robust generalization can be almost as easy as the standard generalization in supervised learning if a sufficiently large amount of unlabeled data is provided. Inspired by the theoretical findings, we propose a new algorithm called PASS by leveraging unlabeled data during adversarial training. We show that in the transductive and semi-supervised settings, PASS achieves higher robust accuracy and defense success rate on the Cifar-10 task.

Subfields: Artificial Intelligence, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Safety, Robustness & Interpretability

Citations in the corpus

Self-Training With Noisy Student Improves ImageNet Classification (2019, positive): “Our finding is consistent with similar arguments that using unlabeled data can improve adversarial robustness [8, 64, 46, 80].”
Adversarial Examples Improve Image Recognition (2019, background): “Other works try to explain this tradeoff phenomenon from the perspective of the increased sample complexity of adversary [37, 25, 28], the limited amount of training data [1, 27, 34, 44, 48], or network overparameterization [31].”
Unlabeled Data Improves Adversarial Robustness (2019, methodology): “[55] study the Gaussian model of [41] and show a PCA-based procedure that successfully leverages unlabeled data to obtain adversarial robustness.”
Are Labels Required for Improving Adversarial Robustness? (2019, background): “The observation that adversarial robustness can be optimized without labels was made independently and concurrently by [10, 33, 53].”
A Closer Look at Accuracy vs. Robustness (2020, methodology): “Neural network classiﬁers are typically obtained by rounding an underlying continuous function f : X → R C with C classes. of f is We take inspiration from prior work, which shows that Lipschitzness closely related to its robustness [10, 21, 46, 60, 64].”
Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attacks (2019, methodology): “One popular and promising defense method is adversarial training (Good-fellow et al., 2014; Szegedy et al., 2014; Zhai et al., 2019; Song et al., 2020 From the perspective of the optimization, the transferability of the adversarial examples is similar with the generalization ability of the trained…”
Towards Deep Learning Models Resistant to Large Perturbations (2020, background): “…a more theoretical perspective (Attias et al., 2018; Chen et al., 2020; Cullina et al., 2018; Diochnos et al., 2019; Gilmer et al., 2018; Ilyas et al., 2019; Khim & Loh, 2018; Montasser et al., 2019; Schmidt et al., 2018; Wang et al., 2017; Yin et al., 2018; Zhai et al., 2019; Zhang et al., 2019).”
Recent Advances in Adversarial Training for Adversarial Robustness (2021, methodology): “Following the analysis of Gaussian models in [Schmidt et al. , 2018], a couple of works [Alayrac et al. , 2019; Carmon et al. , 2019; Zhai et al. , 2019] theoretically show that training with unlabeled data signiﬁcantly reduces the sample complexity gap between standard training and robust training.”
Data Augmentation Can Improve Robustness (2021, background): “Notably, Carmon et al. [7], Hendrycks et al. [25], Najaﬁ et al. [35], Uesato et al. [53], Zhai et al. [59] showed that using additional data improves adversarial robustness, while Gowal et al. [20], Rice et al. [43], Wu et al. [55] found that data augmentation techniques did not boost robustness.”
Fixing Data Augmentation to Improve Adversarial Robustness (2021, background): “In a bid to improve robustness, Hendrycks et al. (2019); Carmon et al. (2019); Uesato et al. (2019); Zhai et al. (2019); Najafi et al. (2019) pioneered the use of additional data (in both fully-supervised and semi-supervised settings).”
Better Diffusion Models Further Improve Adversarial Training (2023, background): “Thus, several pioneer efforts are made to incorporate external datasets into AT (Hendrycks et al., 2019; Carmon et al., 2019; Alayrac et al., 2019; Najafi et al., 2019; Zhai et al., 2019; Wang et al., 2020), either in a fully-supervised or semi-supervised learning paradigm.”
Bag of Tricks for Adversarial Training (2020, background): “…al., 2020c), generative modeling (Jiang et al., 2018; Pang et al., 2018b; Wang & Yu, 2019; Deng et al., 2020), semi-supervised learning (Carmon et al., 2019; Alayrac et al., 2019; Zhai et al., 2019), and self-supervised learning (Hendrycks et al., 2019; Chen et al., 2020a;b; Naseer et al., 2020).”
Improving Robustness using Generated Data (2021, background): “[80] who simultaneously proposed the use of additional unlabeled external data.”
Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examples (2020, background): “…work by Zhang et al. (2019a) who proposed TRADES which balances the trade-off between standard and robust accuracy, and the work by Carmon et al. (2019); Uesato et al. (2019); Najaﬁ et al. (2019); Zhai et al. (2019) who simultaneously proposed the use of additional unlabeled data in this context.”
Improving Adversarial Robustness Requires Revisiting Misclassified Examples (2020, background): “…the sample complexity of adversarial training can be signiﬁcantly higher than that of natural training, that is, training robust DNNs tends to require more data either labeled (Schmidt et al., 2018) or unlabeled ones (Uesato et al., 2019; Carmon et al., 2019; Najaﬁ et al., 2019; Zhai et al., 2019).”
Queried Unlabeled Data Improves and Robustifies Class-Incremental Learning (2022, background): “…more data to achieve adversarially robust generalization (Schmidt et al., 2018; Madry et al., 2018; Shafahi et al., 2020; Kurakin et al., 2016; Zhai et al., 2020), which also challenges CIL where previous classes may only have a handful of stored samples - that is precisely why our queried…”