Fast is better than free: Revisiting adversarial training

By Eric Wong, Leslie Rice, J. Kolter. 2020

1,385 citations recorded by the source corpus.

Adversarial training, a method for learning robust deep networks, is typically assumed to be more expensive than traditional training due to the necessity of constructing adversarial examples via a first-order method like projected gradient decent (PGD). In this paper, we make the surprising discovery that it is possible to train empirically robust models using a much weaker and cheaper adversary, an approach that was previously believed to be ineffective, rendering the method no more costly than standard training in practice. Specifically, we show that adversarial training with the fast gradient sign method (FGSM), when combined with random initialization, is as effective as PGD-based training but has significantly lower cost. Furthermore we show that FGSM adversarial training can be further accelerated by using standard techniques for efficient training of deep networks, allowing us to learn a robust CIFAR10 classifier with 45% robust accuracy to PGD attacks with $\epsilon=8/255$ in 6 minutes, and a robust ImageNet classifier with 43% robust accuracy at $\epsilon=2/255$ in 12 hours, in comparison to past work based on "free" adversarial training which took 10 and 50 hours to reach the same respective thresholds. Finally, we identify a failure mode referred to as "catastrophic overfitting" which may have caused previous attempts to use FGSM adversarial training to fail. All code for reproducing the experiments in this paper as well as pretrained model weights are at this https URL.

Subfields: Artificial Intelligence, Electrical and Electronic Engineering, Safety, Robustness & Interpretability, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Electrical and Electronic Engineering

In Safety, Robustness & Interpretability

In Signal Processing

Citations in the corpus

The Many Faces of Robustness: A Critical Analysis of Out-of-Distribution Generalization (2020, methodology): “We also consider adversarial training as a form of adaptive data augmentation and use the model from [33] trained against `∞ perturbations of size ε = 4/255.”
Natural Adversarial Examples (2019, background): “, 2020 [51], but accuracy decreases to 1.”
Ensemble Adversarial Training: Attacks and Defenses (2017, neutral): “At the same time, a surprising recent result of Wong et al. (2020) suggests that with appropriate step-size tuning and early-stopping, adversarial training with the single-step R+FGSM attack yields models with white-box robustness that is comparable to that obtained with more expensive multi-step…”
On the Stability of Fine-tuning BERT: Misconceptions, Explanations, and Strong Baselines (2020, background): “Along the same lines, You et al. (2020) explicitly remark that bias correction in ADAM has similar effect to warmup which is widely used in deep learning to prevent divergence early in training (He et al., 2016; Goyal et al., 2017; Devlin et al., 2019; Wong et al., 2020).”
Advances in adversarial attacks and defenses in computer vision: A survey (2021, methodology): “[357] showed that adversarial training with FGSM combined with random initialization is as effective as adversarial training with the first order PGD attack.”
Are Transformers More Robust Than CNNs? (2021, methodology): “Following [46, 48], the adversarial training here applies single-step PGD Adversarial Training on Transformers.”
A Survey On Universal Adversarial Attack (2021, background): “A wide range of works [Goodfellow et al., 2015; Madry et al., 2018; Shafahi et al., 2019b; Zhang et al., 2019; Wong et al., 2020] have investigated adversarial training, but the scope of these techniques is often limited to imagedependent attacks.”
Overfitting in adversarially robust deep learning (2020, methodology): “Robust overﬁtting is also not speciﬁc to PGD-based adversarial training, and affects faster adversarial training methods such as FGSM adversarial training 3 (Wong et al., 2020) as well as top performing algorithms for adversarially robust training such as TRADES (Zhang et al., 2019c).”
Understanding and Improving Fast Adversarial Training (2020, methodology): “This phenomenon is called catastrophic overfitting in [47].”
Adversarial Robustness with Semi-Infinite Constrained Learning (2021, background): “Because of this, heuristics [73, 74] are often needed to improve the solutions obtained from (2).”
Attacks Which Do Not Kill Training Make Adversarial Learning Stronger (2020, methodology): “, 2019), computationally efficient adversarial learning (Shafahi et al., 2019; Zhang et al., 2019a; Wong et al., 2020), ensemble adversarial training (Tramr et al.”
Puzzle Mix: Exploiting Saliency and Local Statistics for Optimal Mixup (2020, methodology): “For ImageNet, we modify the training protocol in Wong et al. (2020) and train models for 100 epochs.”
A Closer Look at the Robustness of Vision-and-Language Pre-trained Models (2020, background): “Recently, adversarial training (AT) [69, 74, 55, 50, 79, 71] has shown success on standard V+L tasks [16, 65].”
MEMO: Test Time Robustness via Adaptation and Augmentation (2021, background): “Most prior works in this area have focused on techniques for training time robustification, including utilizing larger models and datasets [34], various forms of adversarial training [39, 48], and aggressive data augmentation [51, 13, 24, 14].”
Smooth Adversarial Training (2020, methodology): “Following [56, 70], we set the maximum per-pixel change (cid:15) = 4 and the attack step size β = 4 in PGD-1.”