Adversarial Examples Improve Image Recognition

Abstract

Adversarial examples are commonly viewed as a threat to ConvNets. Here we present an opposite perspective: adversarial examples can be used to improve image recognition models if harnessed in the right manner. We propose AdvProp, an enhanced adversarial training scheme which treats adversarial examples as additional examples, to prevent overfitting. Key to our method is the usage of a separate auxiliary batch norm for adversarial examples, as they have different underlying distributions to normal examples. We show that AdvProp improves a wide range of models on various image recognition tasks and performs better when the models are bigger. For instance, by applying AdvProp to the latest EfficientNet-B7 [28] on ImageNet, we achieve significant improvements on ImageNet (+0.7%), ImageNet-C (+6.5%), ImageNet-A (+7.0%), Stylized-ImageNet (+4.8%). With an enhanced EfficientNet-B8, our method achieves the state-of-the-art 85.5% ImageNet top-1 accuracy without extra data. This result even surpasses the best model in [20] which is trained with 3.5B Instagram images (~3000X more than ImageNet) and ~9.4X more parameters. Models are available at https://github.com/tensorflow/tpu/tree/master/models/official/efficientnet.

arXiv commentCVPR 2020, models are available at https://github.com/tensorflow/tpu/tree/master/models/official/efficientnet

References in corpus (23)

• Batch Normalization: Accelerating Deep Network Training by Reducing Internal Covariate Shift
• Improved Regularization of Convolutional Neural Networks with Cutout
• Ensemble Adversarial Training: Attacks and Defenses
• Theoretically Principled Trade-off between Robustness and Accuracy
• AutoAugment: Learning Augmentation Policies from Data
• ImageNet-trained CNNs are biased towards texture; increasing shape bias improves accuracy and robustness
• Smart Augmentation - Learning an Optimal Data Augmentation Strategy
• Robustness May Be at Odds with Accuracy
• Self-training with Noisy Student improves ImageNet classification
• Natural Adversarial Examples
• Are Labels Required for Improving Adversarial Robustness?
• Adversarial Training Can Hurt Generalization
• Benchmarking Neural Network Robustness to Common Corruptions and Surface Variations
• Improving Robustness Without Sacrificing Accuracy with Patch Gaussian Augmentation
• A Fourier Perspective on Model Robustness in Computer Vision
• Adversarially Robust Generalization Just Requires More Unlabeled Data
• Adversarial Robustness May Be at Odds With Simplicity
• Interpreting Adversarially Trained Convolutional Neural Networks
• Boosting Adversarial Training with Hypersphere Embedding
• Understanding and Mitigating the Tradeoff Between Robustness and Accuracy
• Confidence-Calibrated Adversarial Training: Generalizing to Unseen Attacks
• The Curious Case of Adversarially Robust Models: More Data Can Help, Double Descend, or Hurt Generalization
• Inductive Bias of Gradient Descent based Adversarial Training on Separable Data

Cited by in corpus (26)

• Large-Scale Adversarial Training for Vision-and-Language Representation Learning
• The Origins and Prevalence of Texture Bias in Convolutional Neural Networks
• Robust Pre-Training by Adversarial Contrastive Learning
• Fixing the train-test resolution discrepancy: FixEfficientNet
• Contrastive Learning with Adversarial Examples
• Affinity and Diversity: Quantifying Mechanisms of Data Augmentation
• KOVIS: Keypoint-based Visual Servoing with Zero-Shot Sim-to-Real Transfer for Robotics Manipulation
• Greedy Policy Search: A Simple Baseline for Learnable Test-Time Augmentation
• Compounding the Performance Improvements of Assembled Techniques in a Convolutional Neural Network
• MaxUp: A Simple Way to Improve Generalization of Neural Network Training
• Improved Sample Complexities for Deep Networks and Robust Classification via an All-Layer Margin
• On Feature Normalization and Data Augmentation
• Towards an Adversarially Robust Normalization Approach
• Intriguing properties of adversarial training at scale
• Semantic Equivalent Adversarial Data Augmentation for Visual Question Answering
• Circumventing Outliers of AutoAugment with Knowledge Distillation
• Adversarial Attacks and Defenses: An Interpretation Perspective
• OpenCoS: Contrastive Semi-supervised Learning for Handling Open-set Unlabeled Data
• Logic-Guided Data Augmentation and Regularization for Consistent Question Answering
• OnlineAugment: Online Data Augmentation with Less Domain Knowledge
• DS-Net++: Dynamic Weight Slicing for Efficient Inference in CNNs and Transformers
• Data Augmentation via Structured Adversarial Perturbations
• Bio-inspired Robustness: A Review
• Do CNNs Encode Data Augmentations?
• Decoder-free Robustness Disentanglement without (Additional) Supervision
• Reject Illegal Inputs with Generative Classifier Derived from Any Discriminative Classifier