Abstract:Adversarial training is one of the most effective approaches to improve model robustness against adversarial examples. However, previous works mainly focus on the overall robustness of the model, and the in-depth analysis on the role of each class involved in adversarial training is still missing. In this paper, we propose to analyze the class-wise robustness in adversarial training. First, we provide a detailed diagnosis of adversarial training on six benchmark datasets, i.e., MNIST, CIFAR-10, CIFAR-100, SVHN, STL-10 and ImageNet. Surprisingly, we find that there are remarkable robustness discrepancies among classes, leading to unbalance/unfair class-wise robustness in the robust models. Furthermore, we keep investigating the relations between classes and find that the unbalanced class-wise robustness is pretty consistent among different attack and defense methods. Moreover, we observe that the stronger attack methods in adversarial learning achieve performance improvement mainly from a more successful attack on the vulnerable classes (i.e., classes with less robustness). Inspired by these interesting findings, we design a simple but effective attack method based on the traditional PGD attack, named Temperature-PGD attack, which proposes to enlarge the robustness disparity among classes with a temperature factor on the confidence distribution of each image. Experiments demonstrate our method can achieve a higher attack rate than the PGD attack. Furthermore, from the defense perspective, we also make some modifications in the training and inference phase to improve the robustness of the most vulnerable class, so as to mitigate the large difference in class-wise robustness. We believe our work can contribute to a more comprehensive understanding of adversarial training as well as rethinking the class-wise properties in robust models.

Classifying Perturbation Types for Robustness Against Multiple Adversarial Perturbations

Improving Adversarial Robustness of 3D Point Cloud Classification Models

Adversarial Training and Robustness for Multiple Perturbations

Towards Defending Multiple ℓ_p-Norm Bounded Adversarial Perturbations Via Gated Batch Normalization

Attacking Adversarial Attacks as A Defense

Towards Robustness against Unsuspicious Adversarial Examples

Enhanced covertness class discriminative universal adversarial perturbations

Towards Defending Multiple $\ell_p$-norm Bounded Adversarial Perturbations via Gated Batch Normalization

Towards the first adversarially robust neural network model on MNIST

Constant Random Perturbations Provide Adversarial Robustness with Minimal Effect on Accuracy

Analysis of Random Perturbations for Robust Convolutional Neural Networks

Perturbation diversity certificates robust generalization

Wide Two-Layer Networks can Learn from Adversarial Perturbations

Towards Class-wise Robustness Analysis

Defending Against Multiple and Unforeseen Adversarial Videos

Universal Adversarial Perturbation for Text Classification

Robust Universal Adversarial Perturbations

Theoretical Understanding of Learning from Adversarial Perturbations

Analysis and Applications of Class-wise Robustness in Adversarial Training

Double Targeted Universal Adversarial Perturbations

Contrasting Adversarial Perturbations: The Space of Harmless Perturbations