Abstract:Deep neural networks can be easily fooled into making incorrect predictions through corruption of the input by adversarial perturbations: human-imperceptible artificial noise. So far adversarial training has been the most successful defense against such adversarial attacks. This work focuses on improving adversarial training to boost adversarial robustness. We first analyze, from an instance-wise perspective, how adversarial vulnerability evolves during adversarial training. We find that during training an overall reduction of adversarial loss is achieved by sacrificing a considerable proportion of training samples to be more vulnerable to adversarial attack, which results in an uneven distribution of adversarial vulnerability among data. Such "uneven vulnerability", is prevalent across several popular robust training methods and, more importantly, relates to overfitting in adversarial training. Motivated by this observation, we propose a new adversarial training method: Instance-adaptive Smoothness Enhanced Adversarial Training (ISEAT). It jointly smooths both input and weight loss landscapes in an adaptive, instance-specific, way to enhance robustness more for those samples with higher adversarial vulnerability. Extensive experiments demonstrate the superiority of our method over existing defense methods. Noticeably, our method, when combined with the latest data augmentation and semi-supervised learning techniques, achieves state-of-the-art robustness against $\ell_{\infty}$-norm constrained attacks on CIFAR10 of 59.32% for Wide ResNet34-10 without extra data, and 61.55% for Wide ResNet28-10 with extra data. Code is available at <a class="link-external link-https" href="https://github.com/TreeLLi/Instance-adaptive-Smoothness-Enhanced-AT" rel="external noopener nofollow">this https URL</a>.

A Patch-wise Adversarial Denoising Could Enhance the Robustness of Adversarial Training

Attack As Defense: Characterizing Adversarial Examples Using Robustness.

Feature Augmentation for Adversarial Robustness

AdvDenoise: Fast Generation Framework of Universal and Robust Adversarial Patches Using Denoise

LDN-RC: a Lightweight Denoising Network with Residual Connection to Improve Adversarial Robustness

Feature Denoising for Improving Adversarial Robustness

Adversarial perturbation denoising utilizing common characteristics in deep feature space

Adversarial Transferability in Deep Denoising Models: Theoretical Insights and Robustness Enhancement via Out-of-Distribution Typical Set Sampling

A hybrid adversarial training for deep learning model and denoising network resistant to adversarial examples

On the Limitations of Denoising Strategies as Adversarial Defenses

Data Augmentation Can Improve Robustness

Decision Boundary-Aware Data Augmentation for Adversarial Training

Minimizing Adversarial Training Samples for Robust Image Classifiers: Analysis and Adversarial Example Generator Design

Improved Adversarial Training Through Adaptive Instance-wise Loss Smoothing

Enhancing adversarial robustness with randomized interlayer processing

Robust and Accurate Object Detection via Adversarial Learning

Detect and defense against adversarial examples in deep learning using natural scene statistics and adaptive denoising

Training Robust Deep Neural Networks via Adversarial Noise Propagation

AdvMask: A Sparse Adversarial Attack Based Data Augmentation Method for Image Classification

ADA: Adversarial Data Augmentation for Object Detection

Detecting adversarial samples by noise injection and denoising