Adversarial Robustness under Long-Tailed Distribution

Abstract

Adversarial robustness has attracted extensive studies recently by revealing the vulnerability and intrinsic characteristics of deep networks. However, existing works on adversarial robustness mainly focus on balanced datasets, while real-world data usually exhibits a long-tailed distribution. To push adversarial robustness towards more realistic scenarios, in this work we investigate the adversarial vulnerability as well as defense under long-tailed distributions. In particular, we first reveal the negative impacts induced by imbalanced data on both recognition performance and adversarial robustness, uncovering the intrinsic challenges of this problem. We then perform a systematic study on existing long-tailed recognition methods in conjunction with the adversarial training framework. Several valuable observations are obtained: 1) natural accuracy is relatively easy to improve, 2) fake gain of robust accuracy exists under unreliable evaluation, and 3) boundary error limits the promotion of robustness. Inspired by these observations, we propose a clean yet effective framework, RoBal, which consists of two dedicated modules, a scale-invariant classifier and data re-balancing via both margin engineering at training stage and boundary adjustment during inference. Extensive experiments demonstrate the superiority of our approach over other state-of-the-art defense methods. To our best knowledge, we are the first to tackle adversarial robustness under long-tailed distributions, which we believe would be a significant step towards real-world robustness. Our code is available at: https://github.com/wutong16/Adversarial_Long-Tail .

arXiv commentAccepted to CVPR 2021 (Oral)

References in corpus (14)

• A systematic study of the class imbalance problem in convolutional neural networks
• Theoretically Principled Trade-off between Robustness and Accuracy
• Learning to Reweight Examples for Robust Deep Learning
• Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks
• Adversarially Robust Generalization Requires More Data
• Fast is better than free: Revisiting adversarial training
• Using Pre-Training Can Improve Model Robustness and Uncertainty
• Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examples
• Smooth Adversarial Training
• MMA Training: Direct Input Space Margin Maximization through Adversarial Training
• Boosting Adversarial Training with Hypersphere Embedding
• Metric Learning for Adversarial Robustness
• Identifying and Compensating for Feature Deviation in Imbalanced Deep Learning
• Label Smoothing and Logit Squeezing: A Replacement for Adversarial Training?