PaperlayerView exact revision on arXiv

Source-linked AI summary

Improving the Generalization of Adversarial Training with Domain Adaptation

Chuanbiao Song, Kun He, Liwei Wang, John E. Hopcroft

arXiv:1810.00740v7cs.LGcs.CVstat.ML

TL;DR

Attack-specific adversarial training can leave models weakly generalized to examples from other attacks, while scalable FGSM training may lack representative adversarial samples. ATDA treats FGSM training as domain adaptation, and the paper reports improved generalization across benchmarks and improved defense performance when extended to PGD training.

  • Problem

    Adversarial training often uses examples from a specific attack, leaving the breadth of adversarial examples insufficiently represented and generalization to other attacks weak.

    Source: §1 · p. 2

  • Method

    ATDA treats FGSM adversarial training as domain adaptation with limited target-domain samples, combining unsupervised and supervised adaptation to reduce the gap between clean and adversarial representations.

    Source: §1 · p. 2, §3 · p. 4

  • Results

    ATDA and its PGD extension PATDA achieve significantly better generalization than competing adversarial-training methods on several benchmark datasets.

    Source: §5 · p. 10

  • Takeaways & Limitations

    The reported approach improves adversarial-example generalization and model smoothness, and can extend from FGSM training to iterative PGD training.

    Source: §5 · p. 10

    The domain-alignment objective assumes clean and adversarial logit-space data each follow a multivariate normal distribution.

    Source: §3.1.1 · p. 4

Abstract

from arXiv · show

By injecting adversarial examples into training data, adversarial training is promising for improving the robustness of deep learning models. However, most existing adversarial training approaches are based on a specific type of adversarial attack. It may not provide sufficiently representative samples from the adversarial domain, leading to a weak generalization ability on adversarial examples from other attacks. Moreover, during the adversarial training, adversarial perturbations on inputs are usually crafted by fast single-step adversaries so as to scale to large datasets. This work is mainly focused on the adversarial training yet efficient FGSM adversary. In this scenario, it is difficult to train a model with great generalization due to the lack of representative adversarial samples, aka the samples are unable to accurately reflect the adversarial domain. To alleviate this problem, we propose a novel Adversarial Training with Domain Adaptation (ATDA) method. Our intuition is to regard the adversarial training on FGSM adversary as a domain adaption task with limited number of target domain samples. The main idea is to learn a representation that is semantically meaningful and domain invariant on the clean domain as well as the adversarial domain. Empirical evaluations on Fashion-MNIST, SVHN, CIFAR-10 and CIFAR-100 demonstrate that ATDA can greatly improve the generalization of adversarial training and the smoothness of the learned models, and outperforms state-of-the-art methods on standard benchmark datasets. To show the transfer ability of our method, we also extend ATDA to the adversarial training on iterative attacks such as PGD-Adversial Training (PAT) and the defense performance is improved considerably.

1 INTRODUCTION

Adversarial training can improve robustness, but training against a specific attack risks overfitting and weak generalization to other attacks. The paper treats FGSM-based training as domain adaptation to align clean and adversarial representations, aiming to improve that generalization.

1 INTRODUCTION

  • Attack-specific adversarial training can overfit its generated examples and generalize weakly to adversaries crafted with other attacks.Adversarial examples can also transfer across models, making robustness important for security-critical computer vision systems such as autonomous driving.Source: §1 · pp. 1–2
  • The paper frames clean and adversarial examples as domains with a gap in high-level representations, while noting that specific-attack samples may not represent the broader adversarial sample space.Iterative noisy attacks have higher computational cost, and the cited discussion says there is no theoretical analysis establishing that their samples sufficiently represent the adversarial domain.Source: §1 · p. 2
  • ATDA treats FGSM adversarial training as domain adaptation with limited target-domain samples and combines unsupervised and supervised adaptation to reduce the clean–adversarial distribution gap.The stated aim is to learn models that generalize across different ℓ∞-bounded attacks.Source: §1 · p. 2
  • Across standard benchmark datasets, ATDA improves adversarial-training generalization despite a small clean-accuracy decay, and the approach also extends to PGD adversarial training.The paper reports improved defense performance for the PGD extension.Source: §1 · p. 2

2 BACKGROUND AND RELATED WORK

The section introduces notation and surveys attack methods and adversarial-training defenses. It highlights the challenge of selecting representative adversaries at scale and the trade-offs between attack strength and computational cost.

2.1 NOTATION

  • The notation defines clean and adversarial domains, a neural classifier, and logits as the final-layer representation before softmax; white-box and black-box attacks differ in access to the target model.The logit space is the semantic space of the logits-layer representation.Source: §2.1 · p. 2

2.2 ATTACK METHODS

  • FGSM is a fast, efficient single-step attack; PGD iterates it, R+FGSM adds random perturbation, and MIM carries gradients across steps.PGD is described as stronger than FGSM in white-box settings but weaker in black-box settings.Source: §2.2 · p. 3

2.3 PROGRESS ON ADVERSARIAL TRAINING

  • Initial adversarial training mixed clean and FGSM examples, while later work replaced half of each batch with adversarial examples and identified label leaking.The cited approach was reported to have weak robustness to RAND+FGSM; ensemble adversarial training instead injects examples transferred from fixed pretrained models.Source: §2.3 · p. 3
  • Training only on adversarial examples and noisy PGD can improve defenses, but iterative attacks increase training time roughly with the number of steps.The cited robust-training method based on linear programming had high clean test error and remained difficult to scale to deep or wide networks.Source: §2.3 · pp. 3–4
  • Adversarial training seeks robustness by injecting adversarial examples into training, but representative examples are difficult and costly to select for large-scale datasets.The region of adversarial examples around each clean example is described as large and contiguous, while methods trained on one attack can generalize weakly to others.Source: §2.3 · p. 4

3 ADVERSARIAL TRAINING WITH DOMAIN ADAPTATION

ATDA treats efficient FGSM adversarial training as domain adaptation with limited adversarial-domain samples, aligning clean and adversarial representations through unsupervised and supervised losses.

3 ADVERSARIAL TRAINING WITH DOMAIN ADAPTATION

  • ATDA combines adversarial training with domain adaptation to reduce clean–adversarial gaps and improve generalization across attacks while retaining an efficient FGSM setting.FGSM examples alone may be aggressive but not representative, since they lie at the ℓ∞-ball boundary and leave interior examples unsampled.Source: §3 · p. 4, §3.2 · p. 5

3.1.1 UNSUPERVISED DOMAIN ADAPTATION

  • Unsupervised adaptation assumes clean and adversarial logits follow multivariate normal distributions, aligning their covariance matrices with CORAL and their mean vectors with MMD.The covariance distance uses an L1 norm.Source: §3.1.1 · p. 4

3.1.2 SUPERVISED DOMAIN ADAPTATION

  • Because distribution alignment alone does not ensure same-label examples are nearby, supervised adaptation uses a margin loss to reduce within-class and increase between-class variation across domains.Class centers are updated using logits from both clean and adversarial domains.Source: §3.1.2 · p. 5

3.2 ADVERSARIAL TRAINING

  • Training generates label-leakage-avoiding FGSM examples, extracts domain logits, updates class centers, and backpropagates a classification-plus-regularization loss.The regularization term is balanced by λ.Source: §3.2 · pp. 5–6

4 EXPERIMENTS

Experiments compare ATDA with established training baselines across four image datasets and bounded white- and black-box attacks. Reported accuracy results show stronger generalization across adversaries than SAT and competing methods.

4.1 EXPERIMENTAL SETUP

  • Evaluation covered Fashion-MNIST, SVHN, CIFAR-10, and CIFAR-100, reporting clean accuracy and defense accuracy on FGSM, PGD, R+FGSM, and MIM.The study evaluates attacks in white-box and black-box settings against normal training and adversarial-training baselines.Source: §4.1 · p. 6

4.3 FURTHER ANALYSIS ON THE DEFENSE PERFORMANCE

  • ATDA's logits representation achieves the best domain invariance, and its local-loss-sensitivity results indicate the smoothest model among the compared methods.The distribution comparison uses Fashion-MNIST logits and MMD distances across clean, FGSM, and PGD domains.Source: §4.3 · pp. 7–8, Table 2 · p. 8, Table 3 · p. 9

4.2 COMPARISON OF DEFENSE PERFORMANCE ON ACCURACY

  • Across benchmarks, ATDA generalizes better across adversaries than SAT and outperforms competing methods; on CIFAR-10 it beats competitors on most attacks despite slightly lower clean accuracy.The accuracy evaluation covers Fashion-MNIST, SVHN, CIFAR-10, and CIFAR-100.Source: §4.2 · p. 7, Table 1 · p. 8

4.4 ABLATION STUDIES ON ATDA

  • UDA's mean-and-covariance alignment is key to improving SAT generalization; SDA helps inconsistently, while combined ATDA gives stable gains and slightly exceeds SAT+UDA.Figure 3 reports average accuracy over white-box and black-box attacks.Source: §4.4 · pp. 8–9, Figure 3 · p. 10

4.5 EXTENSION TO PGD-ADVERSARIAL TRAINING

  • PATDA generally improves robustness over PAT, with gains on CIFAR-10 and CIFAR-100 but not Fashion-MNIST; both methods fail to converge properly on SVHN.PATDA combines noisy-PGD adversarial training with domain adaptation.Source: Table 4 · p. 10, §4.5 · p. 10

5 CONCLUSION

The paper frames FGSM adversarial training as domain adaptation with limited labeled target-domain data, combining supervised and unsupervised adaptation to improve robustness and model smoothness.

  • ATDA combines FGSM adversarial training with supervised and unsupervised domain adaptation, treating adversarial examples as a limited labeled target domain.Source: §5 · p. 10
  • The authors report improved generalization across attacks and greater smoothness of learned models for robust defense.Source: §5 · p. 10
  • ATDA can be extended to iterative attacks such as PGD through PATDA, with improved defense performance.Source: §5 · p. 10
  • Experiments on several benchmark datasets report significantly better generalization for ATDA and PATDA than competing adversarial-training methods.Source: §5 · p. 10

A EXPERIMENTAL DETAILS

The appendix provides experimental settings, network architectures, and training hyper-parameters.

  • The appendix presents the experiments' common settings, neural-network architectures, and training hyper-parameters.Source: A EXPERIMENTAL DETAILS · p. 13

A.1 HYPER-PARAMETERS FOR ADVERSARIES.

The appendix reports common adversary settings and defines ε as the magnitude of adversarial perturbations.

A.2 NEURAL NETWORK ARCHITECTURES AND TRAINING HYPER-PARAMETERS

Training settings vary by dataset, while the appendix provides architecture tables for Fashion-MNIST, SVHN, CIFAR-10, and CIFAR-100.

Fashion-MNIST

  • Fashion-MNIST uses Adam with learning rate 0.001, batch size 64, and perturbations of 0.1 in ℓ∞ norm; its architecture is in Table 6.Source: §A.2 · p. 13, Table 6 · p. 13

SVHN

  • SVHN uses Adam with learning rate 0.001, batch size 32, Fashion-MNIST architectures, and perturbations of 0.02 in ℓ∞ norm.Source: §A.2 · p. 13, Table 6 · p. 13

CIFAR-10

  • CIFAR-10 uses Adam with learning rate 0.001, batch size 32, ELU, Group Normalization, and perturbations of 4/255 in ℓ∞ norm; its architecture is in Table 7.Source: §A.2 · p. 13, Table 7 · p. 14

CIFAR-100

  • CIFAR-100 uses the CIFAR-10 training settings and perturbations of 4/255 in ℓ∞ norm, with its architecture shown in Table 8.Source: §A.2 · p. 13, Table 8 · p. 14
Loading 1810.00740v7…