Adversarial Training for Free!

By Ali Shafahi, Mahyar Najibi, Amin Ghiasi, Zheng Xu, John P. Dickerson, Christoph Studer, Larry S. Davis, Gavin Taylor, Tom Goldstein. 2019

1,469 citations recorded by the source corpus.

Adversarial training, in which a network is trained on adversarial examples, is one of the few defenses against adversarial attacks that withstands strong attacks. Unfortunately, the high cost of generating strong adversarial examples makes standard adversarial training impractical on large-scale problems like ImageNet. We present an algorithm that eliminates the overhead cost of generating adversarial examples by recycling the gradient information computed when updating model parameters. Our "free" adversarial training algorithm achieves comparable robustness to PGD adversarial training on the CIFAR-10 and CIFAR-100 datasets at negligible additional cost compared to natural training, and can be 7 to 30 times faster than other strong adversarial training methods. Using a single workstation with 4 P100 GPUs and 2 days of runtime, we can train a robust model for the large-scale ImageNet classification task that maintains 40% accuracy against PGD attacks. The code is available at this https URL.

Subfields: Optimization & Training, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Optimization & Training

In Safety, Robustness & Interpretability

Citations in the corpus

Adversarial Training for Large Neural Language Models (2020, methodology): “Zhu et al. (2019) adopted the free adversarial training idea in Shafahi et al. (2019) for acceleration, by reusing the backward pass for gradient computation to carry out the inner ascent step Algorithm 1 ALUM Input: T : the total number of iterations, X = { ( x 1 , y 1 ) , ..., ( x n , y n ) } :…”
Measuring Robustness to Natural Distribution Shifts in Image Classification (2020, methodology): “This category includes 86 models with an explicit robustness intervention such as adversarially robust models [13, 27, 72, 74, 101], models with special data augmentation [20, 28, 34, 41, 100, 108, 113], and models with architecture modiﬁcations [115].”
Large-Scale Adversarial Training for Vision-and-Language Representation Learning (2020, background): “Adversarial Training Many efforts have been devoted to improving AT from different angles: (i) use triplet-wise metric learning [8, 7] and optimal transport [20] to leverage inter-sample interactions; (ii) exploit extra unlabeled training data [12, 1]; and (iii) accelerate the training procedure [11”
Advances and Open Problems in Federated Learning (2019, background): “raining. Another issue is that generating adversarial examples is relatively expensive. While some adversarial training frameworks have attempted to minimize this cost by reusing adversarial examples [352], these approaches would still require signiﬁcant compute resources from clients. This is poten”
Adversarial Training and Robustness for Multiple Perturbations (2019, background): “The cost of adversarial training has also be reduced by merging the inner loop of a PGD attack and gradient updates of the model parameters [34, 44], but it is unclear how to extend this approach to a union of perturbations (some of which are not optimized using PGD, e.”
FreeLB: Enhanced Adversarial Training for Natural Language Understanding (2019, methodology): “In the comparisons with standard PGD (Madry et al., 2018), FreeAT (Shafahi et al., 2019) and YOPO (Zhang et al., 2019), FreeLB stands out to be the best for the datasets and models we evaluated.”
Fast is better than free: Revisiting adversarial training (2020, methodology): “Similarly, we train an (cid:96) ∞ robust ImageNet classiﬁer to 43% top-1 accuracy at (cid:15) = 2 / 255 (again matching previous results) in 12 hours of training (compared to 50 hours in the best reported previous work that we are aware of (Shafahi et al., 2019)).”
Robust fine-tuning of zero-shot models (2021, background): “[85] Ali Shafahi, Mahyar Najibi, Amin Ghiasi, Zheng Xu, John Dickerson, Christoph Studer, Larry S Davis, Gavin Taylor, and Tom Goldstein.”
Bag of Tricks for Adversarial Training (2020, methodology): “…other hand, due to the high computational cost of AT, many efforts are devoted to accelerating the training procedure via reusing the computations (Shafahi et al., 2019b; Zhang et al., 2019a), adaptive adversarial steps (Wang et al., 2019; Zhang et al., 2020) or one-step training (Wong et al.,…”
Increasing the robustness of DNNs against image corruptions by playing the Game of Noise (2020, background): “Similarly, the adversarially trained ResNet50 10 from [Shafahi et al., 2019] shows a substantial decrease in performance on common corruptions compared with a vanilla trained model.”
SmoothLLM: Defending Large Language Models Against Jailbreaking Attacks (2023, neutral): “…of the suffix-based attack described in [18] is to solve the feasibility problem in (2.2), which we reproduce here for ease of exposition: Note that any feasible suffix S ⋆ ∈ A m S will be optimal for the following maximization problem. maximize That is, S ⋆ will result in an objective value of…”
Understanding Adversarial Attacks on Deep Learning Based Medical Image Analysis Systems (2019, background): “CIFAR-100/ImageNet versus MNIST/CIFAR-10) is generally more difficult (Shafahi et al., 2019).”
The Pitfalls of Simplicity Bias in Neural Networks (2020, background): “However, on larger datasets such as ImageNet, these methods have limited success [60]; recent attempts [73, 60] that make adversarial training faster do not improve robustness either.”
MMA Training: Direct Input Space Margin Maximization through Adversarial Training (2018, background): “Despite advancements made in recent years (Hendrycks et al., 2019; Zhang et al., 2019a; Shafahi et al., 2019; Zhang et al., 2019b; Stanforth et al., 2019; Carmon et al., 2019), adversarial training still suffers from a fundamental problem, the perturbation length has to be set and is ﬁxed…”
Adversarially Robust Neural Architectures (2020, neutral): “Shafahi et al. [45] introduced an efﬁcient adversarial training which recycled the gradient information.”
Are Transformers More Robust Than CNNs? (2021, background): “However, when increasing the perturbation radius to 4/255, a more challenging but standard case studied in previous works [36, 48, 49], both models will be circumvented completely, i.”