Attacks Which Do Not Kill Training Make Adversarial Learning Stronger

By Jingfeng Zhang, Xilie Xu, Bo Han, Gang Niu, Li-zhen Cui, Masashi Sugiyama, Mohan Kankanhalli. International Conference on Machine Learning, 2020

456 citations recorded by the source corpus.

Adversarial training based on the minimax formulation is necessary for obtaining adversarial robustness of trained models. However, it is conservative or even pessimistic so that it sometimes hurts the natural generalization. In this paper, we raise a fundamental question---do we have to trade off natural generalization for adversarial robustness? We argue that adversarial training is to employ confident adversarial data for updating the current model. We propose a novel approach of friendly adversarial training (FAT): rather than employing most adversarial data maximizing the loss, we search for least adversarial (i.e., friendly adversarial) data minimizing the loss, among the adversarial data that are confidently misclassified. Our novel formulation is easy to implement by just stopping the most adversarial data searching algorithms such as PGD (projected gradient descent) early, which we call early-stopped PGD. Theoretically, FAT is justified by an upper bound of the adversarial risk. Empirically, early-stopped PGD allows us to answer the earlier question negatively---adversarial robustness can indeed be achieved without compromising the natural generalization.

Subfields: Artificial Intelligence

View Paper: https://www.semanticscholar.org/paper/b27da51d2b33c67b1b366f6f3a1e61e84dbab230

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

Citations in the corpus

Constrained Learning With Non-Convex Losses (2021, background): “It has in fact been observed empirically that restricting adversarial training to the early stages of learning can lead to more robust models [77], [78].”
Adversarially Robust Neural Architectures (2020, unknown): “For the evaluation stage, we adopt the popular adversarial training framework FAT [70] to retrain all the baselines.”
A Closer Look at Accuracy vs. Robustness (2020, background): “There is a large body of literature on developing adversarial attacks as well as defenses that apply to neural networks [7, 29, 56, 30, 32, 36, 35, 53, 58, 67].”
The Curious Case of Adversarially Robust Models: More Data Can Help, Double Descend, or Hurt Generalization (2020, methodology): “…Xiao et al., 2019], text recognition and information extraction [Long et al., 2020, Mei et al., 2018, Wang et al., 2012], product recommendations [Zhang et al., 2020], online fraud detection [Pumsirirat and Yan, 2018], self-driving cars [Ramos et al., 2017], information security [Guan et al.,…”
Cross-Entropy Loss Functions: Theoretical Analysis and Applications (2023, methodology): “…al., 2020; Levi et al., 2022; Jin et al., 2022; Awasthi et al., 2023b), curriculum and adaptive attack methods (Cai et al., 2018; Wang et al., 2019; Zhang et al., 2020a; Ding et al., 2022; Cheng et al., 2022), efficient adversarial training (Shafahi et al., 2019; Zhang et al., 2019a; Wong et al.,…”
Geometry-aware Instance-reweighted Adversarial Training (2020, methodology): “We believe this degradation is due to the mismatch between PGD-adversarial training and C&W attacks, which is the common deflect of the empirical defense (Tsuzuku et al., 2018; Wong & Kolter, 2018; Cohen et al., 2019; Balunovic & Vechev, 2020; Zhang et al., 2020a).”
Relating Adversarially Robust Generalization to Flat Minima (2021, methodology): “(13) is combined with a conﬁdence-based weight: L bin ( f (˜ x ; w ) , y ) Avg Flatness PGD-τ : In [103], a variant of PGD is proposed for AT: PGD-τ stops maximization τ iterations after the label ﬂipped.”