Abstract:Adversarial training is one of the most effective approaches to improve model robustness against adversarial examples. However, previous works mainly focus on the overall robustness of the model, and the in-depth analysis on the role of each class involved in adversarial training is still missing. In this paper, we propose to analyze the class-wise robustness in adversarial training. First, we provide a detailed diagnosis of adversarial training on six benchmark datasets, i.e., MNIST, CIFAR-10, CIFAR-100, SVHN, STL-10 and ImageNet. Surprisingly, we find that there are remarkable robustness discrepancies among classes, leading to unbalance/unfair class-wise robustness in the robust models. Furthermore, we keep investigating the relations between classes and find that the unbalanced class-wise robustness is pretty consistent among different attack and defense methods. Moreover, we observe that the stronger attack methods in adversarial learning achieve performance improvement mainly from a more successful attack on the vulnerable classes (i.e., classes with less robustness). Inspired by these interesting findings, we design a simple but effective attack method based on the traditional PGD attack, named Temperature-PGD attack, which proposes to enlarge the robustness disparity among classes with a temperature factor on the confidence distribution of each image. Experiments demonstrate our method can achieve a higher attack rate than the PGD attack. Furthermore, from the defense perspective, we also make some modifications in the training and inference phase to improve the robustness of the most vulnerable class, so as to mitigate the large difference in class-wise robustness. We believe our work can contribute to a more comprehensive understanding of adversarial training as well as rethinking the class-wise properties in robust models.

Learning Task-aware Robust Deep Learning Systems

Attack As Defense: Characterizing Adversarial Examples Using Robustness.

Improving Model Robustness Against Adversarial Examples with Redundant Fully Connected Layer.

ROBY: Evaluating the adversarial robustness of a deep model by its decision boundaries

Towards Class-wise Robustness Analysis

Adversarial Learning from Imbalanced Data: A Robust Industrial Fault Classification Method

Benchmarking Adversarial Robustness on Image Classification

Dynamic Label Adversarial Training for Deep Learning Robustness Against Adversarial Attacks

Towards Deep Learning Models Resistant to Transfer-based Adversarial Attacks via Data-centric Robust Learning

Adversarial Robustness under Long-Tailed Distribution

Dynamic Loss For Robust Learning

Opportunities and Challenges in Deep Learning Adversarial Robustness: A Survey

Holistic Adversarial Robustness of Deep Learning Models

Local Competition and Uncertainty for Adversarial Robustness in Deep Learning

Towards evaluating the robustness of deep diagnostic models by adversarial attack

Analysis and Applications of Class-wise Robustness in Adversarial Training

Interpreting and Evaluating Neural Network Robustness

Enhancing Adversarial Robustness in Low-Label Regime via Adaptively Weighted Regularization and Knowledge Distillation

Towards Deep Learning Models Resistant to Adversarial Attacks

Improving Machine Learning Robustness via Adversarial Training