Data Quality Matters For Adversarial Training: An Empirical Study
arXiv:2102.07437
Abstract
Multiple intriguing problems are hovering in adversarial training, including robust overfitting, robustness overestimation, and robustness-accuracy trade-off. These problems pose great challenges to both reliable evaluation and practical deployment. Here, we empirically show that these problems share one common cause -- low-quality samples in the dataset. Specifically, we first propose a strategy to measure the data quality based on the learning behaviors of the data during adversarial training and find that low-quality data may not be useful and even detrimental to the adversarial robustness. We then design controlled experiments to investigate the interconnections between data quality and problems in adversarial training. We find that when low-quality data is removed, robust overfitting and robustness overestimation can be largely alleviated; and robustness-accuracy trade-off becomes less significant. These observations not only verify our intuition about data quality but may also open new opportunities to advance adversarial training.
References in corpus (38)
- Distilling the Knowledge in a Neural Network
- Wide Residual Networks
- Reconciling modern machine learning practice and the bias-variance trade-off
- Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
- Theoretically Principled Trade-off between Robustness and Accuracy
- Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks
- On Evaluating Adversarial Robustness
- Adversarially Robust Generalization Requires More Data
- Using Pre-Training Can Improve Model Robustness and Uncertainty
- Adversarial Risk and the Dangers of Evaluating Against Weak Attacks
- Adversarial Machine Learning at Scale
- Robustness May Be at Odds with Accuracy
- A Closer Look at Memorization in Deep Networks
- Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methods
- Learning with a Strong Adversary
- Adversarial Robustness through Local Linearization
- Natural Adversarial Examples
- Evaluating the Robustness of Neural Networks: An Extreme Value Theory Approach
- Gradient Descent with Early Stopping is Provably Robust to Label Noise for Overparameterized Neural Networks
- Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examples
- Pervasive Label Errors in Test Sets Destabilize Machine Learning Benchmarks
- Self-Adaptive Training: beyond Empirical Risk Minimization
- Attacks Which Do Not Kill Training Make Adversarial Learning Stronger
- Evaluating and Understanding the Robustness of Adversarial Logit Pairing
- A Closer Look at Accuracy vs. Robustness
- Adversarial Robustness May Be at Odds With Simplicity
- Instance adaptive adversarial training: Improved accuracy tradeoffs in neural nets
- Are Accuracy and Robustness Correlated?
- Confidence-Aware Learning for Deep Neural Networks
- Logit Pairing Methods Can Fool Gradient-Based Attacks
- Robustness to Adversarial Perturbations in Learning from Incomplete Data
- Geometry-aware Instance-reweighted Adversarial Training
- Guided Adversarial Attack for Evaluating and Enhancing Adversarial Defenses
- Adversarial Training is a Form of Data-dependent Operator Norm Regularization
- Robustness for Non-Parametric Classification: A Generic Attack and Defense
- Learnable Boundary Guided Adversarial Training
- Adversarial Perturbations Prevail in the Y-Channel of the YCbCr Color Space
- Evaluating the Robustness of Geometry-Aware Instance-Reweighted Adversarial Training