Abstract:Deep neural networks can be easily fooled into making incorrect predictions through corruption of the input by adversarial perturbations: human-imperceptible artificial noise. So far adversarial training has been the most successful defense against such adversarial attacks. This work focuses on improving adversarial training to boost adversarial robustness. We first analyze, from an instance-wise perspective, how adversarial vulnerability evolves during adversarial training. We find that during training an overall reduction of adversarial loss is achieved by sacrificing a considerable proportion of training samples to be more vulnerable to adversarial attack, which results in an uneven distribution of adversarial vulnerability among data. Such "uneven vulnerability", is prevalent across several popular robust training methods and, more importantly, relates to overfitting in adversarial training. Motivated by this observation, we propose a new adversarial training method: Instance-adaptive Smoothness Enhanced Adversarial Training (ISEAT). It jointly smooths both input and weight loss landscapes in an adaptive, instance-specific, way to enhance robustness more for those samples with higher adversarial vulnerability. Extensive experiments demonstrate the superiority of our method over existing defense methods. Noticeably, our method, when combined with the latest data augmentation and semi-supervised learning techniques, achieves state-of-the-art robustness against $\ell_{\infty}$-norm constrained attacks on CIFAR10 of 59.32% for Wide ResNet34-10 without extra data, and 61.55% for Wide ResNet28-10 with extra data. Code is available at <a class="link-external link-https" href="https://github.com/TreeLLi/Instance-adaptive-Smoothness-Enhanced-AT" rel="external noopener nofollow">this https URL</a>.

Boosting Adversarial Training via Fisher-Rao Norm-based Regularization

GAAT: Group Adaptive Adversarial Training to Improve the Trade-Off Between Robustness and Accuracy

Feature Augmentation for Adversarial Robustness

GEAR: A Margin-based Federated Adversarial Training Approach

Regularization for Adversarial Robust Learning

Regularization properties of adversarially-trained linear regression

Rademacher Complexity for Adversarially Robust Generalization.

Attention-based investigation and solution to the trade-off issue of adversarial training

Rethinking Invariance Regularization in Adversarial Training to Improve Robustness-Accuracy Trade-off

Understanding Robust Overfitting of Adversarial Training and Beyond

Alleviating Robust Overfitting of Adversarial Training With Consistency Regularization

RDAT: an efficient regularized decoupled adversarial training mechanism

Robust Single-step Adversarial Training with Regularizer

Over-parameterized Adversarial Training: An Analysis Overcoming the Curse of Dimensionality

Improved Adversarial Training Through Adaptive Instance-wise Loss Smoothing

RAMP: Boosting Adversarial Robustness Against Multiple $l_p$ Perturbations for Universal Robustness

Lower Difficulty and Better Robustness: A Bregman Divergence Perspective for Adversarial Training

$\ell_\infty$-Robustness and Beyond: Unleashing Efficient Adversarial Training

On the Geometry of Regularization in Adversarial Training: High-Dimensional Asymptotics and Generalization Bounds

Improving Generalization of Adversarial Training via Robust Critical Fine-Tuning

Towards Robust Training of Neural Networks by Regularizing Adversarial Gradients