Abstract:Deep neural networks can be easily fooled into making incorrect predictions through corruption of the input by adversarial perturbations: human-imperceptible artificial noise. So far adversarial training has been the most successful defense against such adversarial attacks. This work focuses on improving adversarial training to boost adversarial robustness. We first analyze, from an instance-wise perspective, how adversarial vulnerability evolves during adversarial training. We find that during training an overall reduction of adversarial loss is achieved by sacrificing a considerable proportion of training samples to be more vulnerable to adversarial attack, which results in an uneven distribution of adversarial vulnerability among data. Such "uneven vulnerability", is prevalent across several popular robust training methods and, more importantly, relates to overfitting in adversarial training. Motivated by this observation, we propose a new adversarial training method: Instance-adaptive Smoothness Enhanced Adversarial Training (ISEAT). It jointly smooths both input and weight loss landscapes in an adaptive, instance-specific, way to enhance robustness more for those samples with higher adversarial vulnerability. Extensive experiments demonstrate the superiority of our method over existing defense methods. Noticeably, our method, when combined with the latest data augmentation and semi-supervised learning techniques, achieves state-of-the-art robustness against $\ell_{\infty}$-norm constrained attacks on CIFAR10 of 59.32% for Wide ResNet34-10 without extra data, and 61.55% for Wide ResNet28-10 with extra data. Code is available at <a class="link-external link-https" href="https://github.com/TreeLLi/Instance-adaptive-Smoothness-Enhanced-AT" rel="external noopener nofollow">this https URL</a>.

Enhancing Certified Robustness of Smoothed Classifiers via Weighted Model Ensembling

Enhancing Certified Robustness via Smoothed Weighted Ensembling

On Multi-head Ensemble of Smoothed Classifiers for Certified Robustness

Promoting Robustness of Randomized Smoothing: Two Cost-Effective Approaches

Regularized Training and Tight Certification for Randomized Smoothed Classifier with Provable Robustness

Boosting Certified Robustness for Time Series Classification with Efficient Self-Ensemble

On the Certified Robustness for Ensemble Models and Beyond

Certified Distributional Robustness on Smoothed Classifiers

GSmooth: Certified Robustness against Semantic Transformations via Generalized Randomized Smoothing

Projected Randomized Smoothing for Certified Adversarial Robustness

(De-)Randomized Smoothing for Decision Stump Ensembles

Certified Adversarial Robustness Within Multiple Perturbation Bounds

Certified Adversarial Robustness Under the Bounded Support Set.

Certified PEFTSmoothing: Parameter-Efficient Fine-Tuning with Randomized Smoothing

Towards Bridging the gap between Empirical and Certified Robustness against Adversarial Examples

DiffSmooth: Certifiably Robust Learning via Diffusion Models and Local Smoothing

RS-Reg: Probabilistic and Robust Certified Regression Through Randomized Smoothing

Provably Robust Cost-Sensitive Learning via Randomized Smoothing

Improved Adversarial Training Through Adaptive Instance-wise Loss Smoothing

Improving the Accuracy-Robustness Trade-Off of Classifiers via Adaptive Smoothing

Towards Assessment of Randomized Smoothing Mechanisms for Certifying Adversarial Robustness