PaperlayerView exact revision on arXiv

Source-linked AI summary

Adversarial Examples Improve Image Recognition

Cihang Xie, Mingxing Tan, Boqing Gong, Jiang Wang, Alan Yuille, Quoc V. Le

arXiv:1911.09665v2cs.CV

TL;DR

Clean and adversarial images have different underlying distributions, making their joint use in recognition training difficult. AdvProp addresses this mismatch with separate auxiliary batch normalization while treating adversarial examples as additional training data. It improves recognition across models and tasks, with EfficientNet-B8 reaching 85.5% ImageNet top-1 accuracy without extra data.

  • Problem

    Adversarial training can degrade clean-image accuracy on large supervised datasets, leaving open how adversarial examples can improve recognition effectively.

  • Method

    AdvProp treats adversarial examples as additional training samples and uses separate batch-normalization statistics for clean and adversarial images.

  • Results

    AdvProp improves models across image-recognition tasks, and EfficientNet-B8 achieves 85.5% ImageNet top-1 accuracy without extra data.

  • Takeaways & Limitations

    Adversarial examples can improve clean image recognition when their distribution is disentangled from clean examples during training.

  • Takeaways & Limitations

    The reported improvement depends partly on architecture: adversarial training remains inferior on ResNet, including ResNet-200.

Abstract

from arXiv · show

Adversarial examples are commonly viewed as a threat to ConvNets. Here we present an opposite perspective: adversarial examples can be used to improve image recognition models if harnessed in the right manner. We propose AdvProp, an enhanced adversarial training scheme which treats adversarial examples as additional examples, to prevent overfitting. Key to our method is the usage of a separate auxiliary batch norm for adversarial examples, as they have different underlying distributions to normal examples. We show that AdvProp improves a wide range of models on various image recognition tasks and performs better when the models are bigger. For instance, by applying AdvProp to the latest EfficientNet-B7 [28] on ImageNet, we achieve significant improvements on ImageNet (+0.7%), ImageNet-C (+6.5%), ImageNet-A (+7.0%), Stylized-ImageNet (+4.8%). With an enhanced EfficientNet-B8, our method achieves the state-of-the-art 85.5% ImageNet top-1 accuracy without extra data. This result even surpasses the best model in [20] which is trained with 3.5B Instagram images (~3000X more than ImageNet) and ~9.4X more parameters. Models are available at https://github.com/tensorflow/tpu/tree/master/models/official/efficientnet.

1. Introduction

The paper reframes adversarial examples as useful training data and proposes AdvProp, which separates clean and adversarial distributions with auxiliary batch normalization. AdvProp improves recognition across clean, corrupted, and stylized-image evaluations, with stronger gains for larger models.

  • Motivation: Adversarial examples are reframed from a ConvNet threat into a potential source of improved recognition accuracy.Prior work often used them for robustness, while supervised ImageNet training could reduce clean-image accuracy.
  • Results: 0.7%: AdvProp raises EfficientNet-B7 ImageNet accuracy from 84.5% to 85.2%.The reported figure compares AdvProp with the vanilla EfficientNet-B7 baseline.
  • Results: 6.5%: AdvProp reduces EfficientNet-B7 ImageNet-C mCE from 59.4% to 52.9%.Lower mCE indicates better corruption performance.
  • Method: AdvProp uses separate batch-normalization statistics for clean images and adversarial examples to address their distribution mismatch.The method treats adversarial examples as additional training samples and disentangles the two distributions during normalization.
  • Results: 85.5%: AdvProp enables EfficientNet-B8 to achieve state-of-the-art ImageNet top-1 accuracy without extra data.The paper reports this result as surpassing a model trained with substantially more Instagram data and parameters.

2. Related Work

The related work positions AdvProp within adversarial training, adversarial-feature learning, and data augmentation. Unlike earlier approaches that often require extra unlabeled data or fail to improve clean accuracy, AdvProp uses adversarial examples as supervised augmentation.

  • Adversarial Training: Adversarial training is established for robustness, but improving clean-image accuracy under supervised learning remains under-explored.Semi-supervised approaches use adversarial examples but require substantial extra unlabeled data.
  • Positioning: AdvProp targets supervised learning without extra data while using adversarial examples to improve clean image recognition.This differs from prior work focused primarily on robustness or semi-supervised utilization.
  • Adversarial Features: Prior studies associate adversarial training with features aligned to salient characteristics, human perception, shape, and robustness to high-frequency noise.These findings motivate treating adversarially learned features as complementary to clean-image features.
  • Data Augmentation: AdvProp can be viewed as data augmentation that creates additional samples by injecting adversarial noise.Earlier random-noise and adversarial-noise augmentation attempts did not improve clean-image accuracy.

3. A Preliminary Way to Boost Performance

The preliminary experiments show that adversarial-only training harms clean-image accuracy, while adversarial pretraining followed by clean-image fine-tuning can partly recover or improve performance. However, the strategy is not consistently better than vanilla training.

  • Adversarial Training: Adversarially trained EfficientNet models obtain lower clean-image accuracy than vanilla counterparts on ImageNet.For EfficientNet-B3, adversarial training reaches 78.2% versus 81.7% for vanilla training.
  • Motivation: The authors attribute this degradation to a distribution mismatch between adversarial examples and clean images.Training exclusively on one domain may not transfer effectively to the other.
  • Fine-tuning: 3.3%: adversarial pretraining followed by clean-image fine-tuning improves EfficientNet-B3 accuracy over the adversarial-training baseline.For EfficientNet-B7, the strategy reaches 84.8% top-1 accuracy, 0.3% above vanilla training.
  • Limitation: The fine-tuning strategy is not generally superior to vanilla training, remaining 0.2% below vanilla for EfficientNet-B3.This limitation motivates a method that jointly retains information from both domains.

4. Methodology

AdvProp jointly trains on clean and adversarial examples while assigning them separate batch-normalization statistics. This disentangles their mixture distribution, enabling simultaneous feature learning and stronger performance than adversarial-training or fine-tuning baselines.

  • AdvProp: AdvProp treats adversarial images as additional samples and jointly optimizes losses from clean and adversarial mini-batches.Clean images use the main batch-normalization layers, while adversarial images use auxiliary layers.
  • Batch Normalization: Batch normalization assumes features come from a single or similar distribution, making mixed clean-adversarial batches problematic.A single set of statistics can estimate normalization parameters inaccurately.
  • Disentangled Learning: Auxiliary batch normalization keeps statistics exclusively for adversarial examples, separating the two components of the mixture distribution.The framework can be extended to multiple auxiliary BNs when training data has multiple sources, such as clean, distorted, and adversarial images.
  • Algorithm: AdvProp generates adversarial counterparts using auxiliary BNs, computes clean and adversarial losses with their respective BNs, and minimizes the total loss.At inference, auxiliary BNs are dropped and only the main BNs are used; training adds 0.5% parameters on EfficientNet-B7.
  • Results: The disentangled framework outperforms adversarial training and the preliminary fine-tuning strategy by jointly learning useful features from both image types.The paper characterizes this benefit as exploiting the complementarity between clean and adversarial examples.

5. Experiments

Across ImageNet and distorted-image evaluations, AdvProp consistently improves recognition, with larger gains for larger networks and stronger generalization than conventional adversarial training. Ablations show that attacker strength, auxiliary batch normalization, architecture, and fine-grained perturbation choices affect the gains.

  • ImageNet results: AdvProp improves all tested networks over vanilla training, with gains of at most 0.4% below EfficientNet-B4 and at least 0.6% above it.The improvement is proportional to network capacity.
  • ImageNet results: 85.2% top-1 accuracy is achieved by AdvProp-trained EfficientNet-B7 on ImageNet, beating the 84.5% prior art by 0.7%.EfficientNet-B6 already surpasses the prior art by 0.3% with approximately 2× less FLOPs than EfficientNet-B7.
  • ImageNet results: 5.1% on ImageNet-C and 3.6% on Stylized-ImageNet are the gains reported for EfficientNet-B3, compared with 0.2% on ImageNet.AdvProp’s improvement is larger on distorted-image datasets than on the original ImageNet.
  • ImageNet results: 52.9% mCE on ImageNet-C, 44.7% top-1 accuracy on ImageNet-A, and 26.6% top-1 accuracy on Stylized-ImageNet are achieved by AdvProp-trained EfficientNet-B7.These are reported as the strongest results on the three datasets without corresponding distortion training or extra data.
  • Attacker strength: Smaller networks favor weaker attackers, while larger networks favor stronger attackers; PGD5 (ϵ=4) raises EfficientNet-B7 accuracy by 0.2% over PGD1 (ϵ=1).EfficientNet-B0 reaches 77.6% with PGD1 (ϵ=1) versus 77.1% with PGD5 (ϵ=4).
  • Comparisons to adversarial training: AdvProp consistently outperforms traditional adversarial training, with the largest ImageNet gap at EfficientNet-B0: 0.9%.The gap decreases from approximately 0.5% through EfficientNet-B5 to 0.3% for B6 and 0.1% for B7.
  • Comparisons to adversarial training: On distorted datasets, AdvProp exceeds adversarial training for EfficientNet-B7 by 3.1% on ImageNet-C, 4.3% on ImageNet-A, and 1.5% on Stylized-ImageNet.For larger networks, the ImageNet improvement over adversarial training is relatively small while distorted-dataset gains remain substantial.
  • Attacker strength: Increasing EfficientNet-B7’s attacker from PGD5 (ϵ=4) to PGD7 (ϵ=6) produces 85.3% ImageNet accuracy with AdvProp, whereas traditional adversarial training falls to 85.0%.The paper attributes the latter decrease possibly to more severe distribution mismatch.

6. Conclusion

AdvProp reframes adversarial examples as useful training data rather than solely a threat. Using auxiliary batch normalization, it improves ConvNet accuracy and reaches 85.5% ImageNet top-1 accuracy without extra data.

  • AdvProp uses adversarial examples to improve ConvNet accuracy instead of treating them only as a threat.
  • Separate auxiliary batch normalization disentangles adversarial and clean images during normalization.
  • 85.5% top-1 accuracy on ImageNet is achieved without extra data by the best model.
Loading 1911.09665v2…