On the Convergence and Robustness of Adversarial Training

By Yisen Wang, Xingjun Ma, James Bailey, Jinfeng Yi, Bowen Zhou, Quanquan Gu. 2021

386 citations recorded by the source corpus.

Improving the robustness of deep neural networks (DNNs) to adversarial examples is an important yet challenging problem for secure deep learning. Across existing defense techniques, adversarial training with Projected Gradient Decent (PGD) is amongst the most effective. Adversarial training solves a min-max optimization problem, with the inner maximization generating adversarial examples by maximizing the classification loss, and the outer minimization finding model parameters by minimizing the loss on adversarial examples generated from the inner maximization. A criterion that measures how well the inner maximization is solved is therefore crucial for adversarial training. In this paper, we propose such a criterion, namely First-Order Stationary Condition for constrained optimization (FOSC), to quantitatively evaluate the convergence quality of adversarial examples found in the inner maximization. With FOSC, we find that to ensure better robustness, it is essential to use adversarial examples with better convergence quality at the later stages of training. Yet at the early stages, high convergence quality adversarial examples are not necessary and may even lead to poor robustness. Based on these observations, we propose a dynamic training strategy to gradually increase the convergence quality of the generated adversarial examples, which significantly improves the robustness of adversarial training. Our theoretical and empirical results show the effectiveness of the proposed method.

Subfields: Artificial Intelligence, Computer Vision and Pattern Recognition, Electrical and Electronic Engineering

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

1. Jun Zhu
2. Xingjun Ma
3. Yisen Wang
4. Hang Su
5. Quanquan Gu
6. Tianyu Pang
7. Yinpeng Dong
8. Bo Li

In Computer Vision and Pattern Recognition

1. Dacheng Tao
2. Luc Van Gool
3. Jun Zhu
4. Xiaogang Wang
5. Hang Su
6. Alan L. Yuille
7. Trevor Darrell
8. Yi Yang

In Electrical and Electronic Engineering

1. Tianyu Pang
2. Jun Zhu
3. Quanquan Gu
4. Boxi Wu
5. Bo Li
6. Bowen Zhou
7. Dongxian Wu
8. Kun Xu

Citations in the corpus

• Attacks Which Do Not Kill Training Make Adversarial Learning Stronger (2020, methodology): “, 2019), curriculum adversarial training (Cai et al., 2018; Wang et al., 2019), computationally efficient adversarial learning (Shafahi et al.”
• Convergence of Adversarial Training in Overparametrized Neural Networks (2019, positive): “From the theoretical perspective, a recent work [46] considers to quantitatively evaluate the convergence quality of adversarial examples found in the inner maximization and therefore ensure robustness.”
• Geometry-aware Instance-reweighted Adversarial Training (2020, methodology): “As for the evaluations, we test the checkpoint using three metrics: standard test accuracy on natural data (Natural), robust test accuracy on adversarial data generated by PGD-20 and PGD+. PGD20 follows the same setting of the PGD-20 used by Wang et al. (2019)5.”
• Clean-Label Backdoor Attacks on Video Recognition Models (2020, background): “Despite great success, DNNs have been criticized due to their low transparency, poor interpretability, and more importantly vulnerabilities to adversarial attacks [25, 8, 16, 30, 32, 31] and backdoor attacks [9, 2, 15, 28, 33].”
• Improving Adversarial Robustness Requires Revisiting Misclassified Examples (2020, methodology): “5 for Dynamic and λ = 4 for TRADES.”
• Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networks (2021, methodology): “A type of well-studied adversary is called the adversarial attack (Szegedy et al., 2013; Goodfellow et al., 2014; Ma et al., 2018; Jiang et al., 2019; Wang et al., 2019b; 2020; Duan et al., 2020; Ma et al., 2020).”
• Black-box Adversarial Attacks on Video Recognition Models (2019, background): “l the network to make a false prediction, while keeping the adversarial example x advwithin the -ball centered at the original example x ( kx advp ). Following early works [19], [21], [34], [35], [36], in this paper, we only focus on the L 1-norm, that is, kx adv 1 adv, but our framework also appli”
• Trustworthy AI: From Principles to Practices (2021, background): “This is typically referred to as adversarial training [134, 211, 346].”
• Adversarial Weight Perturbation Helps Robust Generalization (2020, methodology): “This is because such a large weight perturbation makes DNNs hard to train and severely reduces the training robustness (dashed blue line), which in turns reduces the test robustness though the weight loss landscape is flattened.”
• Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networks (2020, background): “fool state-of-the-art DNNs with high success rate [19,58,44,64,65,67,28,29].”
• Boosting Adversarial Training with Hypersphere Embedding (2020, methodology): “, applying 3-step PGD in PGDAT+HE is more robust than applying 7-step PGD in PGD-AT, which largely reduces the necessary computation [69].”
• Skip Connections Matter: On the Transferability of Adversarial Examples Generated with ResNets (2020, background): “…DNNs have been found extremely vulnerable to adversarial examples (or attacks), which are input examples slightly perturbed with an intention to fool the network to make a wrong prediction (Szegedy et al., 2013; Goodfellow et al., 2014; Ma et al., 2018; Bai et al., 2019; Wang et al., 2019).”