Abstract:Adversarial training is one of the most effective approaches to improve model robustness against adversarial examples. However, previous works mainly focus on the overall robustness of the model, and the in-depth analysis on the role of each class involved in adversarial training is still missing. In this paper, we propose to analyze the class-wise robustness in adversarial training. First, we provide a detailed diagnosis of adversarial training on six benchmark datasets, i.e., MNIST, CIFAR-10, CIFAR-100, SVHN, STL-10 and ImageNet. Surprisingly, we find that there are remarkable robustness discrepancies among classes, leading to unbalance/unfair class-wise robustness in the robust models. Furthermore, we keep investigating the relations between classes and find that the unbalanced class-wise robustness is pretty consistent among different attack and defense methods. Moreover, we observe that the stronger attack methods in adversarial learning achieve performance improvement mainly from a more successful attack on the vulnerable classes (i.e., classes with less robustness). Inspired by these interesting findings, we design a simple but effective attack method based on the traditional PGD attack, named Temperature-PGD attack, which proposes to enlarge the robustness disparity among classes with a temperature factor on the confidence distribution of each image. Experiments demonstrate our method can achieve a higher attack rate than the PGD attack. Furthermore, from the defense perspective, we also make some modifications in the training and inference phase to improve the robustness of the most vulnerable class, so as to mitigate the large difference in class-wise robustness. We believe our work can contribute to a more comprehensive understanding of adversarial training as well as rethinking the class-wise properties in robust models.

Adversarial Robustness under Long-Tailed Distribution Supplementary Material

GAAT: Group Adaptive Adversarial Training to Improve the Trade-Off Between Robustness and Accuracy

Towards Desirable Decision Boundary by Moderate-Margin Adversarial Training

Bag of Tricks for FGSM Adversarial Training

Adversarial Robustness under Long-Tailed Distribution

Improving Model Robustness with Latent Distribution Locally and Globally

Improve Adversarial Robustness Via Probabilistic Distributions Decoupled Network While Guaranteeing Clean Performance

Improving Generalization of Adversarial Training via Robust Critical Fine-Tuning

Improved Adversarial Training Through Adaptive Instance-wise Loss Smoothing

$\ell_\infty$-Robustness and Beyond: Unleashing Efficient Adversarial Training

Understanding Robust Overfitting of Adversarial Training and Beyond

Subspace Adversarial Training

An Empirical Evaluation of Adversarial Robustness under Transfer Learning

Analysis and Applications of Class-wise Robustness in Adversarial Training

Towards Adversarial Robustness with Multidimensional Perturbations Via Contrastive Learning

Improving Adversarial Robustness via Attention and Adversarial Logit Pairing

Lower Difficulty and Better Robustness: A Bregman Divergence Perspective for Adversarial Training

Improving Accuracy-robustness Trade-off via Pixel Reweighted Adversarial Training

Improving Machine Learning Robustness via Adversarial Training

Scaling Compute Is Not All You Need for Adversarial Robustness

Do Wider Neural Networks Really Help Adversarial Robustness?