PaperlayerView exact revision on arXiv

Source-linked AI summary

Geometry-aware Instance-reweighted Adversarial Training

Jingfeng Zhang, Jianing Zhu, Gang Niu, Bo Han, Masashi Sugiyama, Mohan Kankanhalli

arXiv:2010.01736v2cs.LGcs.AI

TL;DR

The paper asks whether adversarial robustness can improve without sacrificing standard accuracy, addressing a direction left unresolved by earlier work. It proposes GAIRAT, which weights adversarial examples by attackability and geometric proximity to the decision boundary. Experiments report improved robustness for standard adversarial training, while combining GAIRAT with FAT improves both robustness and accuracy.

  • Problem

    Whether robustness can be improved while keeping standard accuracy remained unresolved despite methods that improved accuracy while maintaining robustness.

  • Method

    GAIRAT assigns larger adversarial-loss weights to attackable, boundary-near data and smaller weights to guarded data, using PGD attack difficulty as a geometry proxy.

  • Results

    GAIRAT significantly boosts the robustness of standard AT with little accuracy degradation, while GAIR-FAT improves both robustness and accuracy of standard AT.

  • Takeaways & Limitations

    The results support the paper’s conjecture that robustness and accuracy have no inevitable trade-off under geometry-aware instance reweighting.

  • Takeaways & Limitations

    GAIRAT defends PGD attacks well but does not perform equally well against all existing attacks, and optimal weight assignment remains open.

Abstract

from arXiv · show

In adversarial machine learning, there was a common belief that robustness and accuracy hurt each other. The belief was challenged by recent studies where we can maintain the robustness and improve the accuracy. However, the other direction, whether we can keep the accuracy while improving the robustness, is conceptually and practically more interesting, since robust accuracy should be lower than standard accuracy for any model. In this paper, we show this direction is also promising. Firstly, we find even over-parameterized deep networks may still have insufficient model capacity, because adversarial training has an overwhelming smoothing effect. Secondly, given limited model capacity, we argue adversarial data should have unequal importance: geometrically speaking, a natural data point closer to/farther from the class boundary is less/more robust, and the corresponding adversarial data point should be assigned with larger/smaller weight. Finally, to implement the idea, we propose geometry-aware instance-reweighted adversarial training, where the weights are based on how difficult it is to attack a natural data point. Experiments show that our proposal boosts the robustness of standard adversarial training; combining two directions, we improve both robustness and accuracy of standard adversarial training.

1 INTRODUCTION

The paper argues that improving robustness while preserving accuracy is achievable, despite adversarial training’s smoothing effect and unequal data importance. It proposes GAIRAT, which reallocates adversarial-loss weights according to data geometry and attackability.

  • Motivation: Adversarial training has sparked debate over whether robustness and standard accuracy inherently trade off.Recent methods improved accuracy while maintaining robustness, but improving robustness without sacrificing accuracy remained unresolved.
  • Motivation: Over-parameterized networks may still lack capacity for adversarial training because smoothing neighborhoods requires fitting substantially more demanding adversarial data.Adversarial training may require many parameters or sufficiently long training to approach zero adversarial training error.
  • Motivation: Data near the class boundary are more attackable, whereas distant data are more guarded and their adversarial variants are harder to misclassify.As training progresses, guarded examples increase and attackable examples decrease, potentially causing equally weighted guarded variants to overwhelm limited capacity.
  • Method: GAIRAT assigns larger weights to adversarial losses for attackable data and smaller weights for guarded data using attack difficulty as a geometry proxy.The proxy is κ, the least number of PGD iterations needed to generate a misclassified adversarial variant.
  • Results: GAIRAT can relieve robust overfitting and improve robustness with zero or little accuracy degradation, while GAIR-FAT improves both robustness and accuracy over standard AT.The authors use these findings to conjecture that robustness and accuracy have no inevitable trade-off.

2 ADVERSARIAL TRAINING

Adversarial training generates perturbations within an input neighborhood and updates the model using their losses, while FAT selects friendly misclassified variants. The section motivates GAIRAT by noting that equally weighting adversarial examples can be pessimistic and describes PGD as the common search procedure.

  • Learning Objective: The input space uses the infinity metric, with B_ϵ[x] defined as the closed ball of radius ϵ around x.Training data are labeled pairs (x_i, y_i) in the feature and label spaces.
  • Learning Objective: Standard adversarial training generates the highest-loss adversarial data within the ϵ-ball and minimizes their model loss.The loss is built from a base loss and inverse link function, such as cross-entropy and soft-max.
  • Learning Objective: Friendly adversarial training replaces the inner maximization with a constrained minimization that selects misclassified variants with a prescribed loss margin.If the adversarial variant remains correctly classified, FAT imposes no such constraint.
  • Learning Objective: AT and FAT alternate adversarial-data generation with minimizing the generated-data loss with respect to model parameters.This two-step structure underlies adversarially robust network optimization.
  • Realizations: PGD searches for adversarial data by taking loss-gradient steps and projecting each iterate back into the ϵ-ball.AT uses a fixed iteration count, whereas FAT can stop early once misclassification-aware conditions are met.
  • Motivation: Although AT improves adversarial robustness and FAT preserves standard accuracy better, both treat generated adversarial data equally during parameter updates.The paper presents GAIRAT as compatible with AT, FAT, and TRADES to address this weighting issue.

3 GEOMETRY-AWARE INSTANCE-REWEIGHTED ADVERSARIAL TRAINING

GAIRAT addresses insufficient capacity and unequal data importance in adversarial training by reweighting adversarial losses according to attack difficulty and geometric distance.

  • Motivation: Over-parameterized networks may lack sufficient capacity for adversarial data because adversarial training imposes an overwhelming smoothing effect.Networks that fit natural data can remain far from fitting adversarial data under finite training budgets.
  • Motivation: Data closer to the class boundary are more attackable, while farther data are more guarded and their adversarial variants are less important for refining the decision boundary.The geometry value measures this distinction through robustness against adversarial attacks.
  • Implementation: A burn-in period can keep all weights equal initially because geometry is less informative before the classifier is properly learned.The method later introduces instance-dependent weighting after the initial training period.
  • Algorithm: GAIRAT alternates between generating adversarial data with geometry values and minimizing the resulting geometry-reweighted loss with respect to model parameters.GA-PGD supplies both the adversarial example and its natural counterpart’s geometry value for each mini-batch.
  • Learning objective: GAIRAT assigns larger weights to adversarial losses for attackable data and smaller weights for guarded data, using a non-increasing function of geometry value κ.The geometric distance is approximated by the least PGD iterations needed to generate a misclassified adversarial variant, scaled by the PGD step size.
  • Design scope: The optimal weight function remains unknown, so GAIRAT uses heuristically designed non-increasing functions and can extend the approach to FAT and TRADES.These extensions are named GAIR-FAT and GAIR-TRADES.

4 EXPERIMENTS

Experiments evaluate GAIRAT on CIFAR-10 with ResNet-18 and Wide ResNets, showing relief of robust overfitting and improved robustness with little accuracy degradation; combining GAIRAT with FAT improves both.

  • Experimental design: GAIRAT is evaluated for relieving robust overfitting and is benchmarked against AT and FAT using Wide ResNets.The experiments use CIFAR-10 and also include complementary settings across schedules, burn-in periods, datasets, and architectures.
  • GAIRAT relieves robust overfitting: During standard AT, the number of guarded training data increases over training, especially after the learning rate decays at Epoch 30.Learning predominantly from these correctly classified adversarial examples can reinforce existing knowledge and contribute to robust overfitting.
  • GAIRAT relieves robust overfitting: GAIRAT assigns smaller weights to guarded examples to preserve learning focus on the rarer attackable examples.The compared GAIRAT variants introduce instance-dependent weighting after a 30-epoch burn-in period.
  • GAIRAT relieves robust overfitting: GAIRAT achieves lower adversarial test error and higher adversarial training error than standard AT, indicating relief of robust overfitting.The comparison uses ResNet-18 on CIFAR-10 with the Figure 4 training setup.
  • Performance evaluation on Wide ResNets: GAIRAT significantly boosts adversarial robustness with little accuracy degradation compared with standard AT.GAIR-FAT improves both robustness and accuracy relative to standard AT, while FAT improves accuracy with little robustness degradation.

5 CONCLUSION AND FUTURE WORK

The paper concludes that geometry-aware reweighting improves adversarial training under limited capacity, while identifying attack coverage and optimal weighting as unresolved challenges.

  • Conclusion: GAIRAT gives more weight to adversarial data whose natural counterparts are closer to the decision boundary and less weight to those farther away.The method is presented as improving adversarial training under limited model capacity and unequal data geometry.
  • Future work: GAIRAT defends well against PGD attacks but does not perform equally well on all existing attacks.The authors identify incorporating all attacks while preserving efficiency as a future direction.

A MOTIVATIONS OF GAIRAT

The paper argues that adversarial training can remain capacity-limited despite over-parameterization, while data differ in geometric robustness and importance. Experiments examine how network size, perturbation bounds, and decision-boundary geometry relate to these limitations.

  • Insufficient model capacity: Adversarial training may require more capacity because fitting adversarial data demands many parameters or sufficiently long training.The paper emphasizes that this issue becomes especially important under large perturbation bounds.
  • Insufficient model capacity: Standard AT experiments vary network size and ϵtrain to measure natural and adversarial training errors over epochs.The SVHN experiments use the same general setting but report failure beyond ϵ = 16/255.
  • Unequal data importance: Attackable data are closer to the decision boundary, whereas guarded data are farther away and harder to misclassify adversarially.Geometry is approximated by κ, the least number of PGD iterations needed to find a misclassified adversarial variant.

B.1 GEOMETRY-AWARE INSTANCE-REWEIGHTED FRIENDLY ADVERSARIAL TRAINING (GAIR-FAT)

GAIR-FAT extends friendly adversarial training by using geometry-aware instance weights. It generates adversarial examples and geometry values, then uses those values to reweight model updates within the training pipeline.

  • Method: GAIR-FAT modifies friendly adversarial training into a geometry-aware instance-reweighted method.The paper presents GAIRAT as a general framework that can be applied to existing adversarial training methods.
  • Method: The method generates friendly adversarial data and κ(x, y), then updates model parameters using geometry-dependent weights.Algorithm 3 supplies the adversarial data and geometry values, while Algorithm 2 performs the model update.
  • Training procedure: The training loop samples minibatches, computes adversarial examples and κ values, calculates weights, and normalizes them before updating the model.This operational sequence is stated for the geometry-aware TRADES implementation.
  • Extension to TRADES: GAIR-TRADES similarly obtains adversarial data and geometry values before updating parameters with both natural data and adversarial variants.Unlike GAIRAT and GAIR-FAT, this procedure retains both data types in the TRADES update.

C.1 GAIRAT RELIEVES ROBUST OVERFITTING

GAIRAT is evaluated against standard AT using training and test errors, adversarial data, and adversarial-loss flatness. The results associate GAIRAT with reduced robust overfitting and corroborate its effectiveness on SVHN.

  • Experimental comparison: Figure 4 compares AT with GAIRAT variants using different instance-weight assignment functions.Blue lines use decreasing weights, while yellow lines use a non-increasing piece-wise weighting function.
  • Experimental comparison: Natural and robust training/test errors are reported separately, with robust evaluation using PGD-20 adversarial data.Solid lines denote training errors and dashed lines denote test errors.
  • Flatness analysis: Adversarial-loss flatness is measured on friendly and most adversarial test data to examine the geometry around adversarial examples.The friendly-data evaluation uses early-stopped PGD-20-0, while the comparison uses PGD-20.
  • Robust overfitting: Flatness increases abruptly after learning-rate reductions, indicating a more tortuous decision boundary around adversarial data and severe overfitting.The changes occur at learning rates 0.01 and 0.001, at Epochs 30 and 60.
  • Robust overfitting: SVHN experiments corroborate the proposed explanation for robust overfitting and support GAIRAT’s efficacy.The SVHN training and evaluation settings match Figure 4 except for the learning-rate schedule.

C.2 DIFFERENT LEARNING RATE SCHEDULES

The paper tests GAIRAT under multiple learning-rate schedules on CIFAR-10 using pre-activation ResNet-18. Across schedules, GAIRAT is reported to reduce robust overfitting and improve adversarial robustness with little accuracy degradation.

  • Experimental setup: GAIRAT and AT are compared under different learning-rate schedules using pre-activation ResNet-18 on CIFAR-10.The comparison follows a 200-epoch SGD training setup and evaluates robust and standard test errors.
  • Experimental setup: GAIRAT uses the same training configurations as AT, including a 100-epoch burn-in period before geometry-aware reweighting begins.The reported weight function uses λ = −1.
  • Evaluation: Robust test error is evaluated with PGD-20 at ϵ = 8/255 and α = 2/255 after each training epoch.The attack includes a random start with perturbations sampled from [−ϵ, ϵ].
  • Results: Under different learning-rate schedules, GAIRAT relieves robust overfitting and enhances adversarial robustness with little degradation of accuracy.This is the paper’s reported cross-schedule conclusion.

C.3 DIFFERENT WEIGHT ASSIGNMENT FUNCTIONS ω

GAIRAT’s tanh-type weight assignment generally improves robustness over standard AT without materially changing natural-accuracy degradation, while burn-in length controls the robustness–accuracy balance. The method remains effective across datasets and network architectures, and its geometry-aware weighting also improves FAT and MART.

  • Weight assignment functions: The tanh-type decreasing function achieves better robustness than alternative weight assignments while producing similar degradation in standard test accuracy to AT.Figure 12 motivates further experiments with different λ values for the tanh-type function.
  • Weight assignment functions: Smaller λ improves adversarial robustness but causes greater standard-accuracy degradation, whereas larger λ preserves accuracy better with weaker robustness gains.All tested GAIRAT settings still outperform AT in robustness.
  • Evaluation limitation: Under C&W evaluation, robustness for both GAIRAT and AT degrades to around 40%, which the authors attribute to mismatch between PGD training and C&W attacks.The authors leave this mismatch as future work.
  • Different datasets: On SVHN, GAIRAT relieves both robust overfitting and the slight natural-test-accuracy degradation observed with AT, enhancing robustness and accuracy.The SVHN experiments use ResNet-18 and the same general settings as the CIFAR-10 comparison, with a different initial learning rate.
  • Burn-in period: Shorter burn-in periods significantly enhance robustness with slight accuracy loss, while longer periods provide smaller robustness gains with zero accuracy degradation.Longer burn-in makes GAIRAT more like standard AT; AT corresponds to a 100-epoch burn-in period.
  • Different networks: GAIRAT remains effective with Small CNN and VGG-13, although ResNet-18 performs better than Small CNN on both robustness and accuracy.Small CNN exhibits a less severe robust-overfitting problem, yet GAIRAT still improves its robustness.
  • Extensions to FAT and MART: The geometry-aware weighting generalizes beyond AT: GAIR-FAT gains further robustness with near-zero accuracy degradation, and GAIR-MART outperforms MART and MMA.GAIR-MART uses the geometry-aware weight function while otherwise retaining MART’s training configuration.

C.8 PERFORMANCE EVALUATION ON WIDE RESNET (WRN-32-10)

This section evaluates AT, FAT, GAIRAT, and GAIR-FAT on WRN-32-10 using natural accuracy and PGD-based robust accuracy, with best and final checkpoints. PGD attacks with more iterations are also tested for convergence.

  • Experimental setup: AT, FAT, GAIRAT, and GAIR-FAT are evaluated on CIFAR-10 using WRN-32-10 with five repeated trials and different random seeds.The training uses 120 epochs, SGD with momentum, scheduled learning-rate reductions, and standard data augmentation.
  • Checkpoint selection: Best checkpoints are selected from Epochs 59-100 using PGD-20 robust accuracy, while the last checkpoint is taken from Epoch 120.The best-checkpoint procedure is motivated by validation curves matching test curves over epochs.
  • Evaluation protocol: Natural accuracy and robust accuracy under PGD-20 and PGD+ are the three evaluation metrics, using a shared test perturbation bound ϵtest = 0.031.PGD-20 uses 20 steps and step size α = ϵtest/4; PGD+ follows the specified stronger attack protocol.
  • Attack-iteration analysis: PGD-10 through PGD-100 attacks use the same test bound and step size, and the results show convergence with more iterations.The evaluation samples one last checkpoint and one best checkpoint for each defense.

C.9 PERFORMANCE EVALUATION ON WIDE RESNET (GAIR-TRADES)

This section compares GAIR-TRADES with TRADES on CIFAR-10 using WRN-34-10 and evaluates checkpoints by PGD-20 robustness. The reported results show improved accuracy and robustness for GAIR-TRADES.

  • Experimental setup: GAIR-TRADES and TRADES are compared on CIFAR-10 with WRN-34-10 under matched training and evaluation settings.Training lasts 100 epochs with scheduled learning-rate reductions, and the training perturbation bound is ϵtrain = 0.031.
  • Checkpoint selection: Best checkpoints are selected from Epochs 75-100 according to PGD-20 robustness, while the last checkpoint is evaluated at Epoch 100.The experiments report median test accuracy and standard deviation over five repeated trials.
  • Results: GAIR-TRADES achieves both improved accuracy and robustness compared with TRADES.This outcome is stated for the Table 2 comparison on CIFAR-10.

C.10 BENCHMARKING ROBUSTNESS WITH ADDITIONAL UNLABELED (U) DATA

This section benchmarks GAIR-RST by adding instance reweighting to RST and evaluating it with AutoAttack on CIFAR-10 using additional unlabeled data. The geometry-aware method facilitates a competitive model using the extra U data.

  • Additional unlabeled data: RST combines 50K labeled CIFAR-10 examples with 500K pseudo-labeled U data selected from 80 Million Tiny Images.A standard-trained classifier supplies pseudo labels for the selected unlabeled examples.
  • Method: GAIR-RST changes the RST learning objective by introducing instance reweighting into the KL-divergence terms.The objective combines clean cross-entropy with weighted KL terms involving PGD- and C&W-generated adversarial data.
  • Benchmark setup: The benchmark evaluates GAIR-RST against other methods using WRN-28-10, a shared set of U data, and the full AutoAttack suite.The evaluation uses ϵtest = 0.031, matching the training perturbation bound.
  • Results: The geometry-aware instance-reweighted method facilitates a competitive model by utilizing additional U data.This conclusion is reported for the GAIRAT evaluation with additional unlabeled CIFAR-10 data.
Loading 2010.01736v2…