Adversarial Training Can Hurt Generalization

Abstract

While adversarial training can improve robust accuracy (against an adversary), it sometimes hurts standard accuracy (when there is no adversary). Previous work has studied this tradeoff between standard and robust accuracy, but only in the setting where no predictor performs well on both objectives in the infinite data limit. In this paper, we show that even when the optimal predictor with infinite data performs well on both objectives, a tradeoff can still manifest itself with finite data. Furthermore, since our construction is based on a convex learning problem, we rule out optimization concerns, thus laying bare a fundamental tension between robustness and generalization. Finally, we show that robust self-training mostly eliminates this tradeoff by leveraging unlabeled data.

References in corpus (9)

• Theoretically Principled Trade-off between Robustness and Accuracy
• Adversarially Robust Generalization Requires More Data
• Are Labels Required for Improving Adversarial Robustness?
• Rademacher Complexity for Adversarially Robust Generalization
• Adversarially Robust Generalization Just Requires More Unlabeled Data
• Adversarial Robustness May Be at Odds With Simplicity
• Unlabeled Data Improves Adversarial Robustness
• VC Classes are Adversarially Robustly Learnable, but Only Improperly
• Adversarial Risk Bounds via Function Transformation

Cited by in corpus (57)

• AugMix: A Simple Data Processing Method to Improve Robustness and Uncertainty
• The Origins and Prevalence of Texture Bias in Convolutional Neural Networks
• Do Adversarially Robust ImageNet Models Transfer Better?
• Adversarial Training for Large Neural Language Models
• Adversarial Training against Location-Optimized Adversarial Patches
• A Closer Look at Accuracy vs. Robustness
• Unlabeled Data Improves Adversarial Robustness
• Adversarial Examples Improve Image Recognition
• Recent Advances in Adversarial Training for Adversarial Robustness
• Do Wider Neural Networks Really Help Adversarial Robustness?
• The Curious Case of Adversarially Robust Models: More Data Can Help, Double Descend, or Hurt Generalization
• Entropic Out-of-Distribution Detection: Seamless Detection of Unknown Examples
• Improved Sample Complexities for Deep Networks and Robust Classification via an All-Layer Margin
• Interpolated Adversarial Training: Achieving Robust Neural Networks without Sacrificing Too Much Accuracy
• Unadversarial Examples: Designing Objects for Robust Vision
• Viewmaker Networks: Learning Views for Unsupervised Representation Learning
• Once-for-All Adversarial Training: In-Situ Tradeoff between Robustness and Accuracy for Free
• More Data Can Expand the Generalization Gap Between Adversarially Robust and Standard Models
• Online Deterministic Annealing for Classification and Clustering
• Self-supervised Pre-training with Hard Examples Improves Visual Representations
• Annealing Optimization for Progressive Learning with Stochastic Approximation
• How benign is benign overfitting?
• A Robust Adversarial Network-Based End-to-End Communications System With Strong Generalization Ability Against Adversarial Attacks
• Understanding Adversarial Robustness Through Loss Landscape Geometries
• Adversarial Feature Augmentation and Normalization for Visual Recognition
• Invariance-inducing regularization using worst-case transformations suffices to boost accuracy and spatial robustness
• A law of robustness for two-layers neural networks
• Improved OOD Generalization via Adversarial Training and Pre-training
• Data-Efficient GAN Training Beyond (Just) Augmentations: A Lottery Ticket Perspective
• Detecting Adversarial Examples from Sensitivity Inconsistency of Spatial-Transform Domain
• Improving the Robustness of Transformer-based Large Language Models with Dynamic Attention
• Adversarial Learning Guarantees for Linear Hypotheses and Neural Networks
• OnlineAugment: Online Data Augmentation with Less Domain Knowledge
• Adversarially Robust Estimate and Risk Analysis in Linear Regression
• Pelta: Shielding Transformers to Mitigate Evasion Attacks in Federated Learning
• No Surprises: Training Robust Lung Nodule Detection for Low-Dose CT Scans by Augmenting with Adversarial Attacks
• Effective, Efficient and Robust Neural Architecture Search
• Robust and Private Learning of Halfspaces
• StackMix: A complementary Mix algorithm
• CAP: Co-Adversarial Perturbation on Weights and Features for Improving Generalization of Graph Neural Networks
• Analysis and Applications of Class-wise Robustness in Adversarial Training
• Defending Against Image Corruptions Through Adversarial Augmentations
• Asymptotic Behavior of Adversarial Training in Binary Classification
• Beneficial Perturbations Network for Defending Adversarial Examples
• Robust Sensible Adversarial Learning of Deep Neural Networks for Image Classification
• Adversarial Robustness Guarantees for Random Deep Neural Networks
• Fundamental Tradeoffs in Distributionally Adversarial Training
• Reweighting Augmented Samples by Minimizing the Maximal Expected Loss
• Robust binary classification with the 01 loss
• A Law of Robustness for Weight-bounded Neural Networks
• Empirically Measuring Concentration: Fundamental Limits on Intrinsic Robustness
• On the transferability of adversarial examples between convex and 01 loss models
• Who is Responsible for Adversarial Defense?
• Towards adversarial robustness with 01 loss neural networks
• Identifying and Exploiting Structures for Reliable Deep Learning
• Unique properties of adversarially trained linear classifiers on Gaussian data
• Adversarial Training: embedding adversarial perturbations into the parameter space of a neural network to build a robust system