Instance adaptive adversarial training: Improved accuracy tradeoffs in neural nets

Abstract

Adversarial training is by far the most successful strategy for improving robustness of neural networks to adversarial attacks. Despite its success as a defense mechanism, adversarial training fails to generalize well to unperturbed test set. We hypothesize that this poor generalization is a consequence of adversarial training with uniform perturbation radius around every training sample. Samples close to decision boundary can be morphed into a different class under a small perturbation budget, and enforcing large margins around these samples produce poor decision boundaries that generalize poorly. Motivated by this hypothesis, we propose instance adaptive adversarial training -- a technique that enforces sample-specific perturbation margins around every training sample. We show that using our approach, test accuracy on unperturbed samples improve with a marginal drop in robustness. Extensive experiments on CIFAR-10, CIFAR-100 and Imagenet datasets demonstrate the effectiveness of our proposed approach.

References in corpus (3)

• Accurate, Large Minibatch SGD: Training ImageNet in 1 Hour
• Wasserstein Adversarial Examples via Projected Sinkhorn Iterations
• Interpolated Adversarial Training: Achieving Robust Neural Networks without Sacrificing Too Much Accuracy

Cited by in corpus (29)

• Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examples
• Do Adversarially Robust ImageNet Models Transfer Better?
• Adversarial Training against Location-Optimized Adversarial Patches
• Black-box Adversarial Attacks on Commercial Speech Platforms with Minimal Information
• Recent Advances in Adversarial Training for Adversarial Robustness
• Perceptual Adversarial Robustness: Defense Against Unseen Threat Models
• SAT: Improving Adversarial Training via Curriculum-Based Loss Smoothing
• Intriguing properties of adversarial training at scale
• Universum-inspired Supervised Contrastive Learning
• Bag of Tricks for Adversarial Training
• Towards Performance Clarity of Edge Video Analytics
• Stochastic Security: Adversarial Defense Using Long-Run Dynamics of Energy-Based Models
• Increasing-Margin Adversarial (IMA) Training to Improve Adversarial Robustness of Neural Networks
• Recent Advances in Understanding Adversarial Robustness of Deep Neural Networks
• Data Quality Matters For Adversarial Training: An Empirical Study
• Adversarial Training Helps Transfer Learning via Better Representations
• Are Adversarial Examples Created Equal? A Learnable Weighted Minimax Risk for Robustness under Non-uniform Attacks
• RAIN: A Simple Approach for Robust and Accurate Image Classification Networks
• Smoothed Inference for Adversarially-Trained Models
• Understanding the Error in Evaluating Adversarial Robustness
• Insta-RS: Instance-wise Randomized Smoothing for Improved Robustness and Accuracy
• THAT: Two Head Adversarial Training for Improving Robustness at Scale
• SPADE: A Spectral Method for Black-Box Adversarial Robustness Evaluation
• Lagrangian Objective Function Leads to Improved Unforeseen Attack Generalization in Adversarial Training
• Adaptive Adversarial Training Does Not Increase Recourse Costs
• Colored Noise Injection for Training Adversarially Robust Neural Networks
• Get Fooled for the Right Reason: Improving Adversarial Robustness through a Teacher-guided Curriculum Learning Approach
• Calibrated Adversarial Training
• Adaptive perturbation adversarial training: based on reinforcement learning