Adversarial Examples Improve Image Recognition

By Cihang Xie, Mingxing Tan, Boqing Gong, Jiang Wang, Alan L. Yuille, Quoc V. Le. 2019

626 citations recorded by the source corpus.

Adversarial examples are commonly viewed as a threat to ConvNets. Here we present an opposite perspective: adversarial examples can be used to improve image recognition models if harnessed in the right manner. We propose AdvProp, an enhanced adversarial training scheme which treats adversarial examples as additional examples, to prevent overfitting. Key to our method is the usage of a separate auxiliary batch norm for adversarial examples, as they have different underlying distributions to normal examples. We show that AdvProp improves a wide range of models on various image recognition tasks and performs better when the models are bigger. For instance, by applying AdvProp to the latest EfficientNet-B7 [28] on ImageNet, we achieve significant improvements on ImageNet (+0.7%), ImageNet-C (+6.5%), ImageNet-A (+7.0%), Stylized-ImageNet (+4.8%). With an enhanced EfficientNet-B8, our method achieves the state-of-the-art 85.5% ImageNet top-1 accuracy without extra data. This result even surpasses the best model in [20] which is trained with 3.5B Instagram images (~3000X more than ImageNet) and ~9.4X more parameters. Code and models will be made publicly available.

Subfields: Artificial Intelligence, Computer Vision and Pattern Recognition, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Vision and Pattern Recognition

In Safety, Robustness & Interpretability

Citations in the corpus

On Robustness and Transferability of Convolutional Neural Networks (2020, methodology): “Training with adversarial perturbations improves many robustness benchmarks if one uses separate Batch-Norm parameters for clean and adversarial data [69].”
Fixing the train-test resolution discrepancy: FixEfficientNet (2020, methodology): “Mainly these two versions giving the best performance: Efﬁcient-Net trained with adversial examples [8], and EfﬁcientNet trained with Noisy student [9] that are pre-trained in a weakly-supervised fashion on 300 million unlabeled images.”
Measuring Robustness to Natural Distribution Shifts in Image Classification (2020, methodology): “An AdvProp model [100] achieves the highest absolute accuracy on ImageNet-R for a model trained without extra data ( 57 .”
Large-Scale Adversarial Training for Vision-and-Language Representation Learning (2020, methodology): “Adversarial training, a method to combat adversarial attacks in order to create robust neural networks [64, 16], has recently shown great potential in improving the generalization ability of pre-trained language models [86, 24] and image classifiers [72].”
Repurposing Pretrained Models for Robust Out-of-domain Few-Shot Learning (2021, methodology): “Xie et al. (2020) reported improvement using generated examples for adversarial attack on the large scale training.”
Going deeper with Image Transformers (2021, neutral): “[64], EfficientNet [14, 63, 72], Fix-EfficientNet [66] and NFNets [8].”
Logic-Guided Data Augmentation and Regularization for Consistent Question Answering (2020, background): “Sampling augmented data Adding all consistent examples may change the data distribution from the original one, which may lead to a deterioration in performance (Xie et al., 2019).”
Learning What Makes a Difference from Counterfactual Examples and Gradient Supervision (2020, methodology): “Existing methods focus mostly on the generation of these examples then mix them with the original data in a form of data augmentation [34,58,75].”
A Closer Look at the Robustness of Vision-and-Language Pre-trained Models (2020, background): “tioned shows that by injecting adversarial perturbation to multimodal embeddings, PGD-based (Projected Gradient Descent) AT [45, 73, 81, 27, 41, 32] can help the model adapt to linguistic variation and visual content manipulation, yielding better model robustness; but with only limited effect (somet”
Normalization Techniques in Training DNNs: Methodology, Analysis and Application (2020, background): “Similar ideas have also been exploited in unsupervised adversarial domain adaptation in the context of semantic scene segmentation [232] and adversarial examples for improving image recognition [233].”
Circumventing Outliers of AutoAugment with Knowledge Distillation (2020, methodology): “There are 9 variants of EfficientNet [45], named from B0 to B8.”
MaxUp: A Simple Way to Improve Generalization of Neural Network Training (2020, positive): “5% top1 accuracy by Xie et al. (2019) to 85 .”
Semantic Equivalent Adversarial Data Augmentation for Visual Question Answering (2020, methodology): “Recent notable work [41] suggests that adversarial training could boost model performance even on ImageNet with a well-designed training scheme.”
Understanding and Mitigating the Tradeoff Between Robustness and Accuracy (2020, background): “Recently, Xie et al. (2020) showed that adversarial training with appropriate batch normalization (AdvProp) with small perturbations can actually improve standard error.”
CODEs: Chamfer Out-of-Distribution Examples against Overconfidence Issue (2021, methodology): “Particularly, a separate batch norm for CODEs is adopted following [44], which is critical for consistent improve-CIFAR-100 ment.”
RobustBench: a standardized adversarial robustness benchmark (2020, background): “However, despite the simplicity of the `p-perturbation 95 model, it has numerous interesting applications that go beyond security considerations [126, 105] 96 and span transfer learning [106, 130], interpretability [128, 65, 36], generalization [142, 156, 9], 97 robustness to unseen perturbations [6”
Improved Sample Complexities for Deep Networks and Robust Classification via an All-Layer Margin (2019, background): “Xie et al. [2019] demonstrate that adversarial training can be used to improve generalization performance in image recognition.”
Evaluating Machine Accuracy on ImageNet (2020, methodology): “Though models now can nearly perform at 90% accuracy on the ImageNet (Xie et al., 2019b), we do not have much context for what such performance means: what kinds of errors do these models make?”