Source-linked AI summary
Recent Advances in Adversarial Training for Adversarial Robustness
Tao Bai, Jinqi Luo, Jun Zhao, Bihan Wen, Qian Wang
TL;DR
Adversarial examples threaten deep-learning models, while existing surveys neglected recent adversarial-training developments and adversarial training exhibits substantial generalization problems. This survey introduces a novel taxonomy, reviews methods and benchmarks, examines generalization from three perspectives, and identifies unresolved challenges and future directions.
Problem
Adversarial examples can mislead deep-learning classifiers and affect multiple tasks, while recent adversarial-training developments were neglected in existing surveys and robust training has a large generalization gap.
Method
The survey systematically reviews adversarial-training methods using a novel taxonomy, discusses generalization from three perspectives, and summarizes benchmarks with performance comparisons.
Results
TRADES outperforms PGD-AT on CIFAR-10 with error rates reduced by 10%, while the survey identifies several unresolved challenges in adversarial training.
Takeaways & Limitations
Adversarial training remains an active research area because existing methods have not solved deep-learning vulnerability to adversarial examples and require further techniques and investigation.
Takeaways & Limitations
Current adversarial-training methods can struggle to find proper decision boundaries because many standard datasets are distributionally separated relative to attack radii.
Abstract
from arXiv · showhide
Adversarial training is one of the most effective approaches defending against adversarial examples for deep learning models. Unlike other defense strategies, adversarial training aims to promote the robustness of models intrinsically. During the last few years, adversarial training has been studied and discussed from various aspects. A variety of improvements and developments of adversarial training are proposed, which were, however, neglected in existing surveys. For the first time in this survey, we systematically review the recent progress on adversarial training for adversarial robustness with a novel taxonomy. Then we discuss the generalization problems in adversarial training from three perspectives. Finally, we highlight the challenges which are not fully tackled and present potential future directions.
1 Introduction
Adversarial examples can mislead deep neural networks across multiple tasks, motivating defenses. This survey focuses on adversarial training, which incorporates adversarial examples into learning and reviews its recent developments.
- Small, carefully crafted perturbations can cause state-of-the-art classifiers to make erroneous predictions.
- Adversarial examples affect classification, semantic segmentation, object detection, and super-resolution.
- Adversarial training augments each training loop with adversarial examples, aiming to improve behavior under attack.
- The method is formulated as a min-max problem whose inner maximization remains a central challenge.
- The survey addresses recent techniques through a novel taxonomy and examines adversarial-training generalization from different perspectives.
2 Preliminaries
The paper defines adversarial attacks as loss-maximizing perturbations constrained by an l_p budget and evaluates robustness through adversarial test accuracy. Its benchmark table summarizes methods under l∞ attacks.
- Adversarial Attacks: An adversary seeks a perturbation δ within a specified ǫ-budget that maximizes cross-entropy loss and changes the classifier’s prediction.
- Adversarial Attacks: The paper considers l_p-based classification attacks with p ∈ {0, 1, 2, ∞}, typically using small, visually imperceptible perturbations.
- Adversarial Attacks: The adversarial counterpart is formed by adding the estimated perturbation δ to the original input x.
- Table 1 summarizes experimental results for adversarial-training methods, with all attacks constrained by the l∞ norm.
- Adversarial Robustness: Adversarial robustness is measured by classification performance on test data subjected to strong white-box attacks.
3 Adversarial Training for Adversarial Robustness
Adversarial training is widely regarded as an effective practical defense, but its performance remains limited on more challenging datasets and does not fully solve adversarial vulnerability.
- Adversarial training is widely accepted as the most effective practical method for improving adversarial robustness.
- On MNIST, prevailing adversarial-training methods can achieve around 90% worst-case accuracy.
- The paper notes that adversarial training still has a long way to go before handling adversarial attacks perfectly.
3.1 The Origin of Adversarial Training
Adversarial training evolved from mixing clean and adversarial data toward min-max optimization with strong, iterative attacks. PGD-AT became a critical benchmark after substantially improving robustness across attacks.
- Early Methods: Early adversarial training combined clean and adversarial examples, while FGSM generated adversarial examples during training.
- Min-Max Formulation: The min-max formulation trains models to minimize classification error against perturbations that maximize it.
- Min-Max Formulation: The inner maximization searches for worst-case samples within an allowed perturbation set, while outer minimization seeks robust model parameters.
- PGD-AT: Madry et al. used multi-step gradient-based PGD to solve the inner maximization problem.
- PGD-AT: PGD-AT significantly increased adversarial robustness against a wide range of attacks and became the standard practical benchmark.
3.2 Taxonomy of Adversarial Training
The survey organizes recent adversarial-training advances around regularization, attack selection, ensembles, instance adaptation, data efficiency, and computational efficiency. It also connects these approaches to generalization, unlabeled-data requirements, and limitations in choosing decision boundaries.
- Adversarial Regularization: Adversarial regularization decomposes robust error into natural and boundary error, motivating TRADES and later misclassification-aware weighting.TRADES reduces error rates by 10% relative to PGD-AT on CIFAR-10, while MART emphasizes misclassified examples.
- Curriculum-based Adversarial Training: Curriculum-based training gradually strengthens attacks, improving clean-data generalization while preserving adversarial robustness and reducing training time.Weak attacks early in training may support generalization, while varying PGD iteration counts lowers the cost of inner maximization.
- Ensemble Adversarial Training: Ensemble adversarial training increases the number and diversity of target models to approximate the adversarial-example space and the inner maximization optimum.Diversity is promoted through regularizers, input-gradient separation, or vulnerability diversity involving non-robust features.
- Adversarial Training with Adaptive ǫ: Instance-adaptive methods select perturbation budgets per image to reduce the robustness–accuracy trade-off, although robustness can decline slightly.Their decision-boundary assumptions are constrained because many standard datasets have inter-class distances larger than attack budgets.
- Adversarial Training with Semi/Unsupervised Learning: Additional unlabeled data can improve adversarial robustness, but precise data requirements and the costs of collecting and repeatedly training on larger datasets remain unresolved.Supervised adversarial training also exhibits a substantial train–test adversarial-accuracy gap and may require substantially more data than standard training.
- Efficient Adversarial Training: Conventional methods such as PGD-AT take 3-30 times longer than standard training because the min-max inner problem is solved iteratively.YOPO reduces computation by focusing adversary computation on the first layer while freezing other layers.
3.3 Generalization Problem in Adversarial Training
The survey examines adversarial-training generalization across standard accuracy, robustness to adversarial test data, and robustness to unseen attacks. Evidence describes accuracy trade-offs, adversarial overfitting, limited theory, and incomplete study of unseen-attack generalization.
- Standard Generalization: Adversarial training can substantially reduce standard accuracy, motivating analysis of the relationship between standard accuracy and adversarial robustness.
- Standard Generalization: Studies disagree on whether standard accuracy and adversarial robustness are inherently opposed, with some evidence supporting a trade-off and other evidence rejecting it.
- Adversarially Robust Generalization: Adversarially trained models exhibit large training–test gaps on adversarial data across CIFAR-10, SVHN, CIFAR-100, and ImageNet, indicating severe overfitting.
- Adversarially Robust Generalization: More training data may be required for adversarially robust generalization, while empirical methods include semi/unsupervised learning, AVmixup, and robust local features.
- Adversarially Robust Generalization: Theoretical progress on adversarial-training generalization remains limited despite analyses using Rademacher complexity and VC dimension.
- Generalization on Unseen Attacks: Fixed l_p norms and perturbation budgets constrain adversarial training, so robustness to one attack type may not transfer to unseen attacks.
- Generalization on Unseen Attacks: Ensemble adversarial training and attacks using different l_p norms approximate a broader inner-maximization solution space, but unseen-attack generalization remains only occasionally studied.
4 Conclusion and Future Directions
The survey reviews adversarial-training methods, proposes a novel taxonomy, discusses generalization, and summarizes benchmarks and performance comparisons. It concludes that adversarial training has not solved adversarial vulnerability and identifies unresolved optimization, overfitting, and broader-method challenges.
- The survey introduces a novel taxonomy of adversarial-training methods and discusses their generalization problems.
- Min-Max Optimization in Adversarial Training: Adversarial training remains challenged by non-convex min-max optimization, for which existing methods may not obtain global optima or robustness certificates.
- Overfitting in Adversarial Training: Adversarial-training overfitting produces large generalization gaps, and standard deep-learning countermeasures provide limited help.
- Overfitting in Adversarial Training: The survey identifies the need to study intersections among robustness, classifiers, and data distributions, while noting that proposed improvements can be less effective than claimed.