Abstract:Adversarial training is one of the most effective approaches to improve model robustness against adversarial examples. However, previous works mainly focus on the overall robustness of the model, and the in-depth analysis on the role of each class involved in adversarial training is still missing. In this paper, we propose to analyze the class-wise robustness in adversarial training. First, we provide a detailed diagnosis of adversarial training on six benchmark datasets, i.e., MNIST, CIFAR-10, CIFAR-100, SVHN, STL-10 and ImageNet. Surprisingly, we find that there are remarkable robustness discrepancies among classes, leading to unbalance/unfair class-wise robustness in the robust models. Furthermore, we keep investigating the relations between classes and find that the unbalanced class-wise robustness is pretty consistent among different attack and defense methods. Moreover, we observe that the stronger attack methods in adversarial learning achieve performance improvement mainly from a more successful attack on the vulnerable classes (i.e., classes with less robustness). Inspired by these interesting findings, we design a simple but effective attack method based on the traditional PGD attack, named Temperature-PGD attack, which proposes to enlarge the robustness disparity among classes with a temperature factor on the confidence distribution of each image. Experiments demonstrate our method can achieve a higher attack rate than the PGD attack. Furthermore, from the defense perspective, we also make some modifications in the training and inference phase to improve the robustness of the most vulnerable class, so as to mitigate the large difference in class-wise robustness. We believe our work can contribute to a more comprehensive understanding of adversarial training as well as rethinking the class-wise properties in robust models.

Class-Balanced Universal Perturbations for Adversarial Training

Learning Universal Adversarial Perturbation by Adversarial Example

Enhanced covertness class discriminative universal adversarial perturbations

Towards Desirable Decision Boundary by Moderate-Margin Adversarial Training

Comparative Evaluation of Recent Universal Adversarial Perturbations in Image Classification

Generalizing universal adversarial perturbations for deep neural networks

Improving Transferability of Universal Adversarial Perturbation with Feature Disruption.

On the Universal Adversarial Perturbations for Efficient Data-free Adversarial Detection

Universal Adversarial Perturbation Via Prior Driven Uncertainty Approximation

Decision-based Universal Adversarial Attack

Robust Universal Adversarial Perturbations

Double Targeted Universal Adversarial Perturbations

Analysis and Applications of Class-wise Robustness in Adversarial Training

One Perturbation is Enough: On Generating Universal Adversarial Perturbations against Vision-Language Pre-training Models

A Survey on Universal Adversarial Attack

Texture Re-scalable Universal Adversarial Perturbation

Joint Universal Adversarial Perturbations with Interpretations

Fast-UAP: An Algorithm for Speeding up Universal Adversarial Perturbation Generation with Orientation of Perturbation Vectors

Perturbation diversity certificates robust generalization

Universal adversarial perturbations for multiple classification tasks with quantum classifiers

Learning transferable targeted universal adversarial perturbations by sequential meta-learning