Improved Adversarial Training via Learned Optimizer
arXiv:2004.12227
Abstract
Adversarial attack has recently become a tremendous threat to deep learning models. To improve the robustness of machine learning models, adversarial training, formulated as a minimax optimization problem, has been recognized as one of the most effective defense mechanisms. However, the non-convex and non-concave property poses a great challenge to the minimax training. In this paper, we empirically demonstrate that the commonly used PGD attack may not be optimal for inner maximization, and improved inner optimizer can lead to a more robust model. Then we leverage a learning-to-learn (L2L) framework to train an optimizer with recurrent neural networks, providing update directions and steps adaptively for the inner problem. By co-training optimizer's parameters and model's weights, the proposed framework consistently improves the model robustness over PGD-based adversarial training and TRADES.
References in corpus (17)
- Very Deep Convolutional Networks for Large-Scale Image Recognition
- Model-Agnostic Meta-Learning for Fast Adaptation of Deep Networks
- Wide Residual Networks
- Neural Architecture Search: A Survey
- Theoretically Principled Trade-off between Robustness and Accuracy
- Robustness May Be at Odds with Accuracy
- Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Models
- Natural Adversarial Examples
- Learned Optimizers that Scale and Generalize
- Query-Efficient Hard-label Black-box Attack:An Optimization-based Approach
- Generative Adversarial Trainer: Defense to Adversarial Perturbations with GAN
- Evaluating and Understanding the Robustness of Adversarial Logit Pairing
- Understanding and correcting pathologies in the training of learned optimizers
- Understanding Short-Horizon Bias in Stochastic Meta-Optimization
- Learning to Defend by Learning to Attack
- Harnessing the Vulnerability of Latent Layers in Adversarially Trained Models
- Learning to Learn by Zeroth-Order Oracle