PaperlayerView exact revision on arXiv

Source-linked AI summary

Adversarial Vertex Mixup: Toward Better Adversarially Robust Generalization

Saehyung Lee, Hyungyu Lee, Sungroh Yoon

arXiv:2003.02484v3cs.CV

TL;DR

Adversarial training is an effective defense, but robust test accuracy can lag training accuracy, raising the question of whether adversarial-feature generalization is failing. The paper identifies AFO and proposes soft labeling, including AVmixup; experiments report improved robust generalization across benchmark datasets, with a limitation in CW20 performance.

  • Problem

    The paper asks whether failure to generalize across adversarial features explains the gap between test and training accuracy under adversarial perturbations.

    Source: §1 · p. 1

  • Method

    The paper identifies AFO and proposes soft-labeled data augmentation through AVmixup, which interpolates each raw input with a virtual vector in the adversarial direction.

    Source: §1 · p. 2, §3.2 · p. 4

  • Results

    Label smoothing and AVmixup improve robust generalization across CIFAR10, CIFAR100, SVHN, and Tiny ImageNet, and combining AVmixup with a state-of-the-art defense significantly outperforms existing defenses.

    Source: §5 · p. 5

  • Takeaways & Limitations

    The authors present soft labeling as a way to address AFO when robust-learning sample complexity cannot be met.

    Source: §3.2 · p. 4

    AVmixup shows no significant improvement against CW20 on CIFAR10, and this trend becomes more severe on challenging datasets such as CIFAR100.

    Source: §5.2 · p. 7

Abstract

from arXiv · show

Adversarial examples cause neural networks to produce incorrect outputs with high confidence. Although adversarial training is one of the most effective forms of defense against adversarial examples, unfortunately, a large gap exists between test accuracy and training accuracy in adversarial training. In this paper, we identify Adversarial Feature Overfitting (AFO), which may cause poor adversarially robust generalization, and we show that adversarial training can overshoot the optimal point in terms of robust generalization, leading to AFO in our simple Gaussian model. Considering these theoretical results, we present soft labeling as a solution to the AFO problem. Furthermore, we propose Adversarial Vertex mixup (AVmixup), a soft-labeled data augmentation approach for improving adversarially robust generalization. We complement our theoretical analysis with experiments on CIFAR10, CIFAR100, SVHN, and Tiny ImageNet, and show that AVmixup significantly improves the robust generalization performance and that it reduces the trade-off between standard accuracy and adversarial robustness.

1. Introduction

The introduction frames adversarial feature generalization as a possible source of poor robust generalization and presents AFO and AVmixup as theoretical and practical contributions. It motivates soft labeling and evaluates AVmixup across several benchmark datasets.

1. Introduction

  • Many proposed defenses have been defeated by strong attacks or found to rely on obfuscated gradients [17] [19] [3] [1].The introduction also notes that several defenses had been proposed [28] [31] [44].Source: §1 · p. 1
  • The paper asks whether failure to generalize across adversarial features explains the gap between test and training accuracy under adversarial perturbations.It frames this question against the distinction between robust and non-robust features [13].Source: §1 · p. 1
  • The authors identify Adversarial Feature Overfitting (AFO) as overfitting to adversarial features that leads to poor robust generalization.They also present a theoretical analysis of how changes in feature-representation variance affect robust generalization.Source: §1 · p. 2
  • The paper proposes AVmixup, a soft-labeled data augmentation approach, and reports experiments on CIFAR10, CIFAR100, SVHN, and Tiny ImageNet.The authors state that AVmixup substantially increases the effectiveness of state-of-the-art adversarial training methods.Source: §1 · p. 2

2. Background

The background defines robust generalization in relation to adversarial perturbations, reviews robust and non-robust features, and introduces soft labeling and mixup as relevant ideas.

2.1. Adversarially Robust Generalization

  • Schmidt et al. [32] use a toy Gaussian example to show robust generalization can require much larger sample complexity than standard generalization.The model’s classification difficulty depends on σ, which controls the overlap between its two classes.Source: §2.1 · p. 2
  • Standard classification error measures ordinary misclassification, while robust error counts examples misclassified under some allowed perturbation; this paper focuses on ℓ∞-bounded perturbations.The perturbation set is defined by an ℓp norm bound, and ℓ∞ perturbations are described as common in adversarial-robustness work [19] [17] [44] [41].Source: §2.1 · p. 2

2.2. Robust and Non-robust Features

  • Robust and non-robust features can contribute differently to classification: non-robust features may suffice for standard classification but not robust classification [13].Tsipras et al. [36] describe a possible trade-off between standard accuracy and robustness and state that adversarial empirical risk minimization assigns zero weight to non-robust features.Source: §2.2 · p. 2

2.3. Soft Labeling

  • Label smoothing is presented as a regularizer, while Mixup constructs virtual examples by interpolating both inputs and labels [34] [40].Mixup’s interpolation coefficient α lies in [0, 1], and the cited work reports improved generalization across tasks.Source: §2.3 · pp. 2–3

3. Methods

The theoretical analysis links robust generalization to feature-representation variance and identifies AFO when training overfits sufficient non-robust features despite insufficient feature samples. AVmixup addresses this with soft-labeled interpolation toward an adversarial vertex.

3.1. Theoretical Motivation

  • Smaller feature-representation variance is associated with more effective robust generalization in the theoretical model.The analysis argues that matching robust and standard generalization requires lower feature variance than standard learning.Source: §3.1 · p. 3
  • The analysis uses a Gaussian model with one strongly label-correlated robust feature and weakly correlated non-robust features, some of which have insufficient samples.For simplicity, the insufficient features are assumed to share the robust features’ sample distribution.Source: §3.1 · p. 3
  • AFO arises when adversarial training overfits sufficient non-robust features despite insufficient non-robust feature samples, driving their weights toward zero even though the robust-generalization optimum is nonzero.The authors suggest intertwined features may make deep neural networks susceptible to this problem.Source: §3.1 · p. 4

3.2. Adversarial Vertex Mixup

  • Soft labeling is proposed to prevent weights on sufficient non-robust features from reaching zero when the training data contain insufficient non-robust features.The paper presents it as a way to address AFO when robust learning’s large sample complexity cannot be met.Source: §3.2 · p. 4
  • AVmixup interpolates each raw input with a virtual adversarial vertex and interpolates two smoothed versions of its label using the same mixing coefficient.The vertex lies in the adversarial-example direction, γ times farther away; the procedure uses an existing label-smoothing method.Source: §3.2 · pp. 4–5, Figure 1 · p. 4

4. Related Work

This section describes common adversarial attack constructions and groups defense approaches into adversarial training, regularization, denoising, and detection.

4.1. Adversarial Attack Methods

  • FGSM is an efficient one-step attack, while PGD applies a multi-step variant of FGSM and CW uses a specific objective to construct adversarial examples.The section also notes white-box and black-box attacks, including black-box methods based on substitute models or model outputs.Source: §4.1 · p. 5

4.2. Adversarial Defense Methods

  • Defense approaches include adversarial training, robustness-improving regularizers or training variants, and methods that denoise perturbations or detect adversarial inputs.Adversarial training uses adversarial examples as training data.Source: §4.2 · p. 5

5. Experimental Results And Discussion

Experiments across CIFAR10, CIFAR100, SVHN, and Tiny ImageNet report improved robust accuracy with AVmixup, with further gains when combined with Feature Scatter. On CIFAR10, the results also show continued robustness improvement during training and a limitation against CW20 attacks.

5.1. Implementation Details

  • Experiments use WRN-34-10 on CIFAR, WRN-16-8 on SVHN, and PreActResNet18 on Tiny ImageNet, with 80k steps for CIFAR and SVHN and 50k for Tiny ImageNet.The reported perturbation budget is ϵ = 8; evaluation attacks include FGSM, PGD, CW, and transfer-based black-box attacks.Source: §5.1 · pp. 5–6

5.2. CIFAR10

  • On CIFAR10, soft-label models outperform one-hot PGD training across clean and adversarial evaluations; AVmixup gains 11.89%p on PGD20 versus PGD, with a 2.24%p Clean decrease versus Standard.The white-box evaluations include Clean, FGSM, PGD10, PGD20, and CW20.Source: Table 1 · p. 6, §5.2 · p. 6
  • PGD-trained robustness starts to overfit at about 40k steps, while AVmixup robustness continues to improve.The curves are for CIFAR10 validation accuracy against PGD10.Source: §5.2 · p. 6, Figure 2 · p. 6
  • In transfer-based black-box evaluations on CIFAR10, AVmixup is most robust across attack models, and its black-box accuracy exceeds its white-box accuracy.The authors interpret this as evidence that its defense improvement is not due to obfuscated gradients.Source: §5.2 · p. 6, Table 2 · p. 7
  • Against TRADES on CIFAR10, AVmixup has superior robustness with a smaller trade-off.The authors contrast AVmixup’s implementation cost with TRADES’ approximately twice-as-much GPU memory requirement.Source: §5.2 · pp. 6–7, Table 3 · p. 7
  • AVmixup shows no significant improvement against CW20, with this trend more severe on challenging datasets such as CIFAR100; its robustness may not extend to other attack types.The discussion connects this limitation to linear interpolation and emphasizes the diversity of adversarial examples during training.Source: §5.2 · p. 7

5.3. Other Datasets

  • Compared with PGD, AVmixup gains 13.52%p Clean and 13.32%p PGD20 on CIFAR100, 3.19%p and 3.68%p on SVHN, and 12.6%p and 7.17%p on Tiny ImageNet.The SVHN improvements are described as smaller than those on the other tested datasets.Source: Table 4 · p. 7, §5.3 · p. 7

5.4. When AVmixup Meets Diversity

  • On CIFAR10, AVmixup with Feature Scatter reaches 82.31% PGD20 and 81.88% PGD100 accuracy, with significant improvement over Feature Scatter alone and gains against CW as well as PGD attacks.The comparison covers AVmixup with Feature Scatter and Feature Scatter alone.Source: Table 5 · p. 8, §5.4 · p. 8

6. Conclusion

The conclusion identifies Adversarial Feature Overfitting (AFO) and reports theoretical and empirical support for soft labeling and AVmixup as ways to improve robust generalization. It also notes that AVmixup’s linear interpolation requires time-consuming hyperparameter search when resources are limited.

6. Conclusion

  • The paper identifies AFO as a phenomenon leading to poor robust generalization and uses theoretical and empirical approaches to show how soft labeling can help.It introduces AVmixup as a soft-labeled data augmentation method and reports strong performance in extensive experiments.Source: §6 · p. 8
  • AVmixup uses linear interpolation without accounting for the nature of adversarial examples, so appropriate hyperparameters must be found by line search or exhaustive search.The authors describe this search as time-consuming when resources are limited.Source: §6 · p. 8
  • Future work aims to analyze the meaning and effects of AVmixup’s linear interpolation in detail to develop advanced algorithms.Source: §6 · p. 8

A. Proofs

The proofs relate feature-variance settings to bounds on classification error and formulate variance-minimizing feature weights. They also state that adversarial empirical risk minimization assigns zero weight to non-robust features.

A. Proofs

  • When σr=νσs for ν∈[0,1] and the stated standard and robust error bounds are equal, Corollary 1 says the upper bound on ϵ increases as σr decreases, in proportion to πn,σs.Source: A. Proofs · p. 11
  • Theorems 2 and 3 define wB as minimizing the variance of w^T x, respectively with respect to Ψsample,c and Ψtrue.The proof also states that the resulting optimal weight can be used to predict robust generalization performance.Source: A. Proofs · p. 12
  • The stated lemma says minimizing adversarial empirical risk assigns zero weight to non-robust features.The proof attributes this to adversarial updates moving those weights toward zero when η<ϵ.Source: A. Proofs · p. 12

B. Dataset

The dataset discussion contrasts the class counts and data per class of CIFAR10 and SVHN with CIFAR100 and Tiny Imagenet. The related-work discussion distinguishes AVmixup’s training-time interpolation from other mixup-based approaches.

B. Dataset

  • CIFAR10 and SVHN have fewer classes and more data per class than CIFAR100 and Tiny Imagenet, whose classification tasks are described as significantly more difficult.Source: B. Dataset · p. 12

C. Further Related Work

  • Mixup Inference [43] interpolates an adversarial example and a sampled clean example at inference, whereas AVmixup is applied during training.MI focuses on globally linear behavior between data manifolds introduced by mixup training.Source: C. Further Related Work · p. 13
  • Interpolated Adversarial Training uses losses from clean-example and adversarial-example interpolations, while AVmixup interpolates a clean example with its adversarial vertex.The passage says IAT improves standard test error while maintaining robustness, whereas AVmixup improves both standard accuracy and adversarial robustness.Source: C. Further Related Work · p. 13

D. Detailed Experimental Results

The detailed results report AVmixup gains on several CIFAR100 white-box evaluations, with a limited CW20 improvement, and strong transfer-based black-box robustness on CIFAR10 and CIFAR100.

D. Detailed Experimental Results

  • In detailed CIFAR100 white-box attack results, AVmixup significantly improves accuracy for Clean, FGSM, and PGD, but its improvement for CW20 remains limited.Source: D. Detailed Experimental Results · p. 13
  • The CIFAR100 white-box results distinguish gains across Clean, FGSM, PGD, and CW20 rather than showing uniform improvement across attack types.Source: D. Detailed Experimental Results · p. 13
  • Against transfer-based black-box attacks, AVmixup is the most robust model against attacks from all attack models, with significant margins.The results discussed include CIFAR10 and CIFAR100; Table 9 and Table 10 encode attack models by column and evaluated defense models by row.Source: D. Detailed Experimental Results · p. 13

E. Empirical Evidence on the Nature of Mixup

The comparisons examine whether mixup generalizes to clean inputs and inputs changed by Gaussian noise. Noisy mixup performs best on Noise but worst on Clean, with a 2.29%p Noise-over-Clean accuracy difference.

E. Empirical Evidence on the Nature of Mixup

F. Ablation Study on CIFAR10

The ablation study reports that accuracy outcomes vary with AVmixup’s label-smoothing and scaling-factor settings. The reported γ optima differ between PGD-based and feature scattering-based approaches.

F. Ablation Study on CIFAR10

  • Larger λ1 corresponds to higher Clean accuracy, while λ1 and λ2 weight standard accuracy and adversarial robustness, respectively.The reported weights do not fit perfectly because other conditions also change.Source: F. Ablation Study on CIFAR10 · p. 14
  • AVmixup yields its highest accuracy at γ = 1 with the PGD-based approach and γ = 2 with the feature scattering-based approach.The authors relate the difference to how the approaches construct adversarial examples.Source: F. Ablation Study on CIFAR10 · p. 14, Table 13 · p. 15
  • PGD constructs multi-step adversarial examples in the ℓ∞-bounded cube, whereas feature scattering uses a one-step method placing them on its surface.The authors state that PGD requires a larger scaling factor to cover the bounded space, while feature scattering requires a factor of 1.Source: F. Ablation Study on CIFAR10 · p. 14
  • AVmixup’s sensitivity is linked to label-smoothing factors and their relationship to the classifier’s Lipschitz constant in adversarial directions.The authors describe this complex relationship as causing the observed high sensitivity and as a direction for future research.Source: F. Ablation Study on CIFAR10 · p. 14
Loading 2003.02484v3…