Fast is better than free: Revisiting adversarial training

Abstract

Adversarial training, a method for learning robust deep networks, is typically assumed to be more expensive than traditional training due to the necessity of constructing adversarial examples via a first-order method like projected gradient decent (PGD). In this paper, we make the surprising discovery that it is possible to train empirically robust models using a much weaker and cheaper adversary, an approach that was previously believed to be ineffective, rendering the method no more costly than standard training in practice. Specifically, we show that adversarial training with the fast gradient sign method (FGSM), when combined with random initialization, is as effective as PGD-based training but has significantly lower cost. Furthermore we show that FGSM adversarial training can be further accelerated by using standard techniques for efficient training of deep networks, allowing us to learn a robust CIFAR10 classifier with 45% robust accuracy to PGD attacks with $\epsilon =8/255$ in 6 minutes, and a robust ImageNet classifier with 43% robust accuracy at $\epsilon =2/255$ in 12 hours, in comparison to past work based on "free" adversarial training which took 10 and 50 hours to reach the same respective thresholds. Finally, we identify a failure mode referred to as "catastrophic overfitting" which may have caused previous attempts to use FGSM adversarial training to fail. All code for reproducing the experiments in this paper as well as pretrained model weights are at https://github.com/locuslab/fast_adversarial.

References in corpus (21)

• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Mixed Precision Training
• Provable defenses against adversarial examples via the convex outer adversarial polytope
• Certified Adversarial Robustness via Randomized Smoothing
• On Evaluating Adversarial Robustness
• Countering Adversarial Images using Input Transformations
• Adversarial Risk and the Dangers of Evaluating Against Weak Attacks
• Detecting Adversarial Samples from Artifacts
• Evaluating Robustness of Neural Networks with Mixed Integer Programming
• Certifying Some Distributional Robustness with Principled Adversarial Training
• PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examples
• On the Effectiveness of Interval Bound Propagation for Training Verifiably Robust Models
• Provably Robust Deep Learning via Adversarially Trained Smoothed Classifiers
• Defensive Distillation is Not Robust to Adversarial Examples
• NO Need to Worry about Adversarial Examples in Object Detection in Autonomous Vehicles
• Semidefinite relaxations for certifying robustness to adversarial examples
• Evaluating and Understanding the Robustness of Adversarial Logit Pairing
• Provable Robustness of ReLU networks via Maximization of Linear Regions
• ME-Net: Towards Effective Adversarial Robustness with Matrix Estimation
• Logit Pairing Methods Can Fool Gradient-Based Attacks
• Is AmI (Attacks Meet Interpretability) Robust to Adversarial Examples?

Cited by in corpus (155)

• Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks
• Large-Scale Adversarial Training for Vision-and-Language Representation Learning
• Invisible for both Camera and LiDAR: Security of Multi-Sensor Fusion based Perception in Autonomous Driving Under Physical-World Attacks
• Hardware and Software Optimizations for Accelerating Deep Neural Networks: Survey of Current Trends, Challenges, and the Road Ahead
• On the Stability of Fine-tuning BERT: Misconceptions, Explanations, and Strong Baselines
• Adversarial Weight Perturbation Helps Robust Generalization
• Natural Adversarial Examples
• Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examples
• RobustBench: a standardized adversarial robustness benchmark
• Torchattacks: A PyTorch Repository for Adversarial Attacks
• When Vision Transformers Outperform ResNets without Pre-training or Strong Data Augmentations
• A Review of Adversarial Attack and Defense for Classification Methods
• Smooth Adversarial Training
• A Survey On Universal Adversarial Attack
• MEMO: Test Time Robustness via Adaptation and Augmentation
• The Pitfalls of Simplicity Bias in Neural Networks
• Adversarial Training against Location-Optimized Adversarial Patches
• Attacks Which Do Not Kill Training Make Adversarial Learning Stronger
• An overview of mixing augmentation methods and augmentation strategies
• Towards quantum enhanced adversarial robustness in machine learning
• Black-box Adversarial Attacks on Commercial Speech Platforms with Minimal Information
• Semantic Robustness of Models of Source Code
• Boosting Adversarial Training with Hypersphere Embedding
• Contrastive Learning with Adversarial Examples
• ImageNet-Patch: A Dataset for Benchmarking Machine Learning Robustness against Adversarial Patches
• Overfitting in adversarially robust deep learning
• RoPGen: Towards Robust Code Authorship Attribution via Automatic Coding Style Transformation
• Understanding and Improving Fast Adversarial Training
• On the Loss Landscape of Adversarial Training: Identifying Challenges and How to Overcome Them
• Do Wider Neural Networks Really Help Adversarial Robustness?
• Adversarial Distributional Training for Robust Deep Learning
• Exploring Architectural Ingredients of Adversarially Robust Deep Neural Networks
• Entropic Out-of-Distribution Detection: Seamless Detection of Unknown Examples
• Opportunities and Challenges in Deep Learning Adversarial Robustness: A Survey
• Exposing Previously Undetectable Faults in Deep Neural Networks
• Towards Understanding Fast Adversarial Training
• Dual Manifold Adversarial Robustness: Defense against Lp and non-Lp Adversarial Attacks
• AdvFlow: Inconspicuous Black-box Adversarial Attacks using Normalizing Flows
• Probabilistic Margins for Instance Reweighting in Adversarial Training
• Robustness May Be at Odds with Fairness: An Empirical Study on Class-wise Accuracy
• This Looks Like That... Does it? Shortcomings of Latent Space Prototype Interpretability in Deep Networks
• On Fast Adversarial Robustness Adaptation in Model-Agnostic Meta-Learning
• SAT: Improving Adversarial Training via Curriculum-Based Loss Smoothing
• On the effectiveness of adversarial training against common corruptions
• Physically Realizable Adversarial Examples for LiDAR Object Detection
• Pasadena: Perceptually Aware and Stealthy Adversarial Denoise Attack
• A Real-time Defense against Website Fingerprinting Attacks
• Understanding the Interaction of Adversarial Training with Noisy Labels
• Boosting Discriminative Visual Representation Learning with Scenario-Agnostic Mixup
• Exploring Memorization in Adversarial Training
• Puzzle-AE: Novelty Detection in Images through Solving Puzzles
• Attacking Adversarial Attacks as A Defense
• Learnable Boundary Guided Adversarial Training
• Adversarial Image Color Transformations in Explicit Color Filter Space
• Bag of Tricks for Adversarial Training
• How benign is benign overfitting?
• LTD: Low Temperature Distillation for Gradient Masking-free Adversarial Training
• Towards Security Threats of Deep Learning Systems: A Survey
• Post-breach Recovery: Protection against White-box Adversarial Examples for Leaked DNN Models
• Manifold Regularization for Locally Stable Deep Neural Networks
• On the Generalization Properties of Adversarial Training
• Evaluating Robustness to Context-Sensitive Feature Perturbations of Different Granularities
• Adversarial Robustness under Long-Tailed Distribution
• DSRNA: Differentiable Search of Robust Neural Architectures
• Fighting Gradients with Gradients: Dynamic Defenses against Adversarial Attacks
• Adversarial Visual Robustness by Causal Intervention
• Dynamically Sampled Nonlocal Gradients for Stronger Adversarial Attacks
• Calibrated Language Model Fine-Tuning for In- and Out-of-Distribution Data
• Imbalanced Gradients: A Subtle Cause of Overestimated Adversarial Robustness
• Adversarial Robustness through the Lens of Convolutional Filters
• Trigger Hunting with a Topological Prior for Trojan Detection
• RNAS-CL: Robust Neural Architecture Search by Cross-Layer Knowledge Distillation
• SOAR: Second-Order Adversarial Regularization
• Guided Interpolation for Adversarial Training
• Calibration and Consistency of Adversarial Surrogate Losses
• BulletTrain: Accelerating Robust Neural Network Training via Boundary Example Mining
• Adversarially Trained Object Detector for Unsupervised Domain Adaptation
• STRATA: Simple, Gradient-Free Attacks for Models of Code
• Towards Rapid and Robust Adversarial Training with One-Step Attacks
• Adversarial Robustness with Non-uniform Perturbations
• Toward Adversarial Robustness via Semi-supervised Robust Training
• Sequential Randomized Smoothing for Adversarially Robust Speech Recognition
• Adversarial Transfer Attacks With Unknown Data and Class Overlap
• Towards Evaluating the Robustness of Neural Networks Learned by Transduction
• AccelAT: A Framework for Accelerating the Adversarial Training of Deep Neural Networks through Accuracy Gradient
• Mind the box: $l_1$-APGD for sparse adversarial attacks on image classifiers
• Amplification trojan network: Attack deep neural networks by amplifying their inherent weakness
• Drawing Robust Scratch Tickets: Subnetworks with Inborn Robustness Are Found within Randomly Initialized Networks
• Understanding Catastrophic Overfitting in Adversarial Training
• Meta Adversarial Perturbations
• Analysis and Applications of Class-wise Robustness in Adversarial Training
• LAFEAT: Piercing Through Adversarial Defenses with Latent Features
• Defending Against Image Corruptions Through Adversarial Augmentations
• Assessment of the Reliablity of a Model's Decision by Generalizing Attribution to the Wavelet Domain
• FAT: Federated Adversarial Training
• Amata: An Annealing Mechanism for Adversarial Training Acceleration
• Effective, Efficient and Robust Neural Architecture Search
• Learning Diverse-Structured Networks for Adversarial Robustness
• Towards Certifying L-infinity Robustness using Neural Networks with L-inf-dist Neurons
• On the Noise Stability and Robustness of Adversarially Trained Networks on NVM Crossbars
• Push Stricter to Decide Better: A Class-Conditional Feature Adaptive Framework for Improving Adversarial Robustness
• Towards Deep Learning Models Resistant to Large Perturbations
• Anti-Bandit Neural Architecture Search for Model Defense
• Soft Adversarial Training Can Retain Natural Accuracy
• Multi-stage Optimization based Adversarial Training
• Meta-Learning the Search Distribution of Black-Box Random Search Based Adversarial Attacks
• Concurrent Adversarial Learning for Large-Batch Training
• Visually Imperceptible Adversarial Patch Attacks on Digital Images
• Multi-objective Search of Robust Neural Architectures against Multiple Types of Adversarial Attacks
• Adversarial Robustness through Bias Variance Decomposition: A New Perspective for Federated Learning
• A Geometrical Approach to Evaluate the Adversarial Robustness of Deep Neural Networks
• Language Guided Adversarial Purification
• Exploring Adversarial Robustness of Deep Metric Learning
• ZeroGrad : Mitigating and Explaining Catastrophic Overfitting in FGSM Adversarial Training
• Heating up decision boundaries: isocapacitory saturation, adversarial scenarios and generalization bounds
• Enhance Diffusion to Improve Robust Generalization
• The art of defense: letting networks fool the attacker
• Domain Invariant Adversarial Learning
• Adversarial Attacks on ML Defense Models Competition
• "What's in the box?!": Deflecting Adversarial Attacks by Randomly Deploying Adversarially-Disjoint Models
• Model-Agnostic Meta-Attack: Towards Reliable Evaluation of Adversarial Robustness
• Adaptive Image Transformations for Transfer-based Adversarial Attack
• Towards Speeding up Adversarial Training in Latent Spaces
• Utilizing Adversarial Targeted Attacks to Boost Adversarial Robustness
• Point Adversarial Self Mining: A Simple Method for Facial Expression Recognition
• Enhanced countering adversarial attacks via input denoising and feature restoring
• THAT: Two Head Adversarial Training for Improving Robustness at Scale
• Adaptive Clustering of Robust Semantic Representations for Adversarial Image Purification
• Real-time Detection of Practical Universal Adversarial Perturbations
• One Neuron to Fool Them All
• Improving Hierarchical Adversarial Robustness of Deep Neural Networks
• Content-Adaptive Pixel Discretization to Improve Model Robustness
• Adversarial Learning with Cost-Sensitive Classes
• SPADE: A Spectral Method for Black-Box Adversarial Robustness Evaluation
• Deep Repulsive Prototypes for Adversarial Robustness
• Overfitting or Underfitting? Understand Robustness Drop in Adversarial Training
• Dynamic Efficient Adversarial Training Guided by Gradient Magnitude
• Reject Illegal Inputs with Generative Classifier Derived from Any Discriminative Classifier
• Skew Orthogonal Convolutions
• Countering Adversarial Examples: Combining Input Transformation and Noisy Training
• A Novel Information-Theoretic Objective to Disentangle Representations for Fair Classification
• Adversarial Defenses via Vector Quantization
• Amicable Aid: Perturbing Images to Improve Classification Performance
• Identifying and Exploiting Structures for Reliable Deep Learning
• Adaptive Perturbation for Adversarial Attack
• Subspace Adversarial Training
• Get Fooled for the Right Reason: Improving Adversarial Robustness through a Teacher-guided Curriculum Learning Approach
• Ensemble of Models Trained by Key-based Transformed Images for Adversarially Robust Defense Against Black-box Attacks
• A Variational Inequality Approach to Bayesian Regression Games
• Shape Defense Against Adversarial Attacks
• Query-Free Adversarial Transfer via Undertrained Surrogates
• Initializing Perturbations in Multiple Directions for Fast Adversarial Training
• Robust Face Verification via Disentangled Representations
• Black-box Adversarial Example Generation with Normalizing Flows
• Adversarial Training with Stochastic Weight Average