On the Convergence and Robustness of Adversarial Training

Abstract

Improving the robustness of deep neural networks (DNNs) to adversarial examples is an important yet challenging problem for secure deep learning. Across existing defense techniques, adversarial training with Projected Gradient Decent (PGD) is amongst the most effective. Adversarial training solves a min-max optimization problem, with the \textit{inner maximization} generating adversarial examples by maximizing the classification loss, and the \textit{outer minimization} finding model parameters by minimizing the loss on adversarial examples generated from the inner maximization. A criterion that measures how well the inner maximization is solved is therefore crucial for adversarial training. In this paper, we propose such a criterion, namely First-Order Stationary Condition for constrained optimization (FOSC), to quantitatively evaluate the convergence quality of adversarial examples found in the inner maximization. With FOSC, we find that to ensure better robustness, it is essential to use adversarial examples with better convergence quality at the \textit{later stages} of training. Yet at the early stages, high convergence quality adversarial examples are not necessary and may even lead to poor robustness. Based on these observations, we propose a \textit{dynamic} training strategy to gradually increase the convergence quality of the generated adversarial examples, which significantly improves the robustness of adversarial training. Our theoretical and empirical results show the effectiveness of the proposed method.

arXiv commentICML 2019 Long Talk. Fixing bugs in the proof of Theorem 1

References in corpus (8)

• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Towards Deep Neural Network Architectures Robust to Adversarial Examples
• Countering Adversarial Images using Input Transformations
• Certifying Some Distributional Robustness with Principled Adversarial Training
• Improving the Adversarial Robustness and Interpretability of Deep Neural Networks by Regularizing their Input Gradients
• Stochastic Gradient Descent Optimizes Over-parameterized Deep ReLU Networks
• Deep Defense: Training DNNs with Improved Adversarial Robustness
• Minimax Statistical Learning with Wasserstein Distances

Cited by in corpus (74)

• Understanding Adversarial Attacks on Deep Learning Based Medical Image Analysis Systems
• Adversarial Weight Perturbation Helps Robust Generalization
• Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networks
• A Review of Adversarial Attack and Defense for Classification Methods
• Smooth Adversarial Training
• Attacks Which Do Not Kill Training Make Adversarial Learning Stronger
• Boosting Adversarial Training with Hypersphere Embedding
• Convergence of Adversarial Training in Overparametrized Neural Networks
• Unlearnable Examples: Making Personal Data Unexploitable
• Understanding and Improving Fast Adversarial Training
• Recent Advances in Adversarial Training for Adversarial Robustness
• Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networks
• Do Wider Neural Networks Really Help Adversarial Robustness?
• PAD: Towards Principled Adversarial Malware Detection Against Evasion Attacks
• Geometry-aware Instance-reweighted Adversarial Training
• Exploring Architectural Ingredients of Adversarially Robust Deep Neural Networks
• GANs May Have No Nash Equilibria
• Towards Understanding Fast Adversarial Training
• Reliable Adversarial Distillation with Unreliable Teachers
• SAT: Improving Adversarial Training via Curriculum-Based Loss Smoothing
• Adversarial Camouflage: Hiding Physical-World Attacks with Natural Styles
• Clean-Label Backdoor Attacks on Video Recognition Models
• Adversarial training in communication constrained federated learning
• Understanding the Interaction of Adversarial Training with Noisy Labels
• Exploring Memorization in Adversarial Training
• Provably Efficient Black-Box Action Poisoning Attacks Against Reinforcement Learning
• Bag of Tricks for Adversarial Training
• Certified Robustness to Word Substitution Ranking Attack for Neural Ranking Models
• SoK: Machine Learning Governance
• Backdoor Attacks on Crowd Counting
• CIFS: Improving Adversarial Robustness of CNNs via Channel-wise Importance-based Feature Selection
• Bridging the Performance Gap between FGSM and PGD Adversarial Training
• On the Generalization Properties of Adversarial Training
• Black-box Adversarial Attacks on Video Recognition Models
• RayS: A Ray Searching Method for Hard-label Adversarial Attack
• Adversarial Attacks on Black Box Video Classifiers: Leveraging the Power of Geometric Transformations
• Evaluating the Robustness of Geometry-Aware Instance-Reweighted Adversarial Training
• Instance Correction for Learning with Open-set Noisy Labels
• Better Safe Than Sorry: Preventing Delusive Adversaries with Adversarial Training
• Improving Query Efficiency of Black-box Adversarial Attack
• Formalizing Generalization and Robustness of Neural Networks to Weight Perturbations
• Guided Interpolation for Adversarial Training
• Local Reweighting for Adversarial Training
• Revisiting Adversarial Robustness Distillation: Robust Soft Labels Make Student Better
• RobOT: Robustness-Oriented Testing for Deep Learning Systems
• Adversarially Robust Estimate and Risk Analysis in Linear Regression
• Learning Diverse-Structured Networks for Adversarial Robustness
• Analysis and Applications of Class-wise Robustness in Adversarial Training
• Understanding the Intrinsic Robustness of Image Distributions using Conditional Generative Models
• Where is the Bottleneck of Adversarial Learning with Unlabeled Data?
• Adaptive Feature Alignment for Adversarial Training
• Amata: An Annealing Mechanism for Adversarial Training Acceleration
• Adversarial Robustness through Bias Variance Decomposition: A New Perspective for Federated Learning
• Clustering Effect of (Linearized) Adversarial Robust Models
• A Unified Game-Theoretic Interpretation of Adversarial Robustness
• Multi-objective Search of Robust Neural Architectures against Multiple Types of Adversarial Attacks
• Smoothed Inference for Adversarially-Trained Models
• Robust Deep Learning as Optimal Control: Insights and Convergence Guarantees
• ATRAS: Adversarially Trained Robust Architecture Search
• Enhance Diffusion to Improve Robust Generalization
• Adaptive Image Transformations for Transfer-based Adversarial Attack
• Improving White-box Robustness of Pre-processing Defenses via Joint Adversarial Training
• Domain Invariant Adversarial Learning
• Dynamic Efficient Adversarial Training Guided by Gradient Magnitude
• Non-Singular Adversarial Robustness of Neural Networks
• Model-Agnostic Defense for Lane Detection against Adversarial Attack
• Provable Robustness of Adversarial Training for Learning Halfspaces with Noise
• Dual Head Adversarial Training
• An Integrated Approach to Produce Robust Models with High Efficiency
• Adversarial Interaction Attack: Fooling AI to Misinterpret Human Intentions
• Robust Neural Networks inspired by Strong Stability Preserving Runge-Kutta methods
• What Can Style Transfer and Paintings Do For Model Robustness?
• Get Fooled for the Right Reason: Improving Adversarial Robustness through a Teacher-guided Curriculum Learning Approach
• Calibrated Adversarial Training