You Only Propagate Once: Accelerating Adversarial Training via Maximal Principle

By Dinghuai Zhang, Tianyuan Zhang, Yiping Lu, Zhanxing Zhu, Bin Dong. 2019

394 citations recorded by the source corpus.

Deep learning achieves state-of-the-art results in many tasks in computer vision and natural language processing. However, recent works have shown that deep networks can be vulnerable to adversarial perturbations, which raised a serious robustness issue of deep networks. Adversarial training, typically formulated as a robust optimization problem, is an effective way of improving the robustness of deep networks. A major drawback of existing adversarial training algorithms is the computational overhead of the generation of adversarial examples, typically far greater than that of the network training. This leads to the unbearable overall computational cost of adversarial training. In this paper, we show that adversarial training can be cast as a discrete time differential game. Through analyzing the Pontryagin's Maximal Principle (PMP) of the problem, we observe that the adversary update is only coupled with the parameters of the first layer of the network. This inspires us to restrict most of the forward and back propagation within the first layer of the network during adversary updates. This effectively reduces the total number of full forward and backward propagation to only one for each group of adversary updates. Therefore, we refer to this algorithm YOPO (You Only Propagate Once). Numerical experiments demonstrate that YOPO can achieve comparable defense accuracy with approximately 1/5 ~ 1/4 GPU time of the projected gradient descent (PGD) algorithm. Our codes are available at https://https://github.com/a1600012888/YOPO-You-Only-Propagate-Once.

Subfields: Artificial Intelligence, Computer Vision and Pattern Recognition, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Vision and Pattern Recognition

In Safety, Robustness & Interpretability

Citations in the corpus

Large-Scale Adversarial Training for Vision-and-Language Representation Learning (2020, methodology): “To power efﬁcient large-scale training, we adopt the recently proposed “free” adversarial training strategy [56, 81, 85], which obtains the gradients of parameters with almost no extra cost when computing the gradients of inputs.”
Fast is better than free: Revisiting adversarial training (2020, methodology): “Finally, when performing a multi-step PGD adversary, it is possible to cut out redundant calculations during backpropagation when computing adversarial examples for additional speedup (Zhang et al., 2019).”
Overfitting in adversarially robust deep learning (2020, methodology): “Robust overﬁtting is also not speciﬁc to PGD-based adversarial training, and affects faster adversarial training methods such as FGSM adversarial training 3 (Wong et al., 2020) as well as top performing algorithms for adversarially robust training such as TRADES (Zhang et al., 2019c).”
A Survey on Data Augmentation for Text Classification (2021, neutral): “[125] accumulates the gradients with respect to the parameters from the K steps and updates the parameters accordingly.”
Intriguing properties of adversarial training (2019, background): “Subsequent works are then proposed to further improve the model robustness (Xie et al., 2019b; Zhang et al., 2019b; Hendrycks et al., 2019a; Qin et al., 2019; Zhang & Wang, 2019; Carmon et al., 2019; Hendrycks et al., 2019b; Alayrac et al., 2019; Zhai et al., 2019) or accelerate the adversarial…”
Boosting Adversarial Training with Hypersphere Embedding (2020, methodology): “Various efforts have been devoted to improving AT from different aspects, including accelerating the training procedure [63, 64, 78, 88] and exploiting extra labeled and unlabeled training data [1, 10, 27, 87], which are conducive in the cases with limited computational resources or additional data ”
Better Diffusion Models Further Improve Adversarial Training (2023, methodology): “Moreover, because of high computational cost of AT, various attempts have been made to accelerate the training phase by reusing calculation (Shafahi et al., 2019; Zhang et al., 2019a) or onestep training (Wong et al., 2020; Liu et al., 2020; Vivek B & Venkatesh Babu, 2020).”
Understanding and Improving Fast Adversarial Training (2020, methodology): “Unlike [28] and [49], with the training scheme of [47] and α = ε/2 we could successfully train a PGD-2 model with ε = 8/255 on CIFAR-10 with robustness better than that of their methods that use the same number of PGD steps (see Appendix D.”
Relating Adversarially Robust Generalization to Flat Minima (2021, background): “14 [145] Dinghuai Zhang, Tianyuan Zhang, Yiping Lu, Zhanxing Zhu, and Bin Dong.”
A Survey On Universal Adversarial Attack (2021, background): “A wide range of works [Goodfellow et al., 2015; Madry et al., 2018; Shafahi et al., 2019b; Zhang et al., 2019; Wong et al., 2020] have investigated adversarial training, but the scope of these techniques is often limited to imagedependent attacks.”
Attacks Which Do Not Kill Training Make Adversarial Learning Stronger (2020, background): “The time-consuming factor depends on the number of BPs used for generating adversarial data [27, 28, 29].”
Adversarial Attacks and Defenses in Images, Graphs and Text: A Review (2019, methodology): “Moreover, a number of studies reported the relation between these two properties (Tsipras et al., 2018; Su et al., 2018; Stutz et al., 2019; Zhang et al., 2019b).”
MMA Training: Direct Input Space Margin Maximization through Adversarial Training (2018, background): “Despite advancements made in recent years (Hendrycks et al., 2019; Zhang et al., 2019a; Shafahi et al., 2019; Zhang et al., 2019b; Stanforth et al., 2019; Carmon et al., 2019), adversarial training still suffers from a fundamental problem, the perturbation length has to be set and is ﬁxed…”