PaperlayerView exact revision on arXiv

Source-linked AI summary

Data Augmentation Can Improve Robustness

Sylvestre-Alvise Rebuffi, Sven Gowal, Dan A. Calian, Florian Stimberg, Olivia Wiles, Timothy Mann

arXiv:2111.05328v1cs.CVcs.LGstat.ML

TL;DR

Adversarial training suffers from robust overfitting, motivating methods that preserve robust accuracy during training. The paper combines data augmentation with model weight averaging and reports improved robustness across perturbation settings, architectures, and datasets. It concludes that augmentation can benefit adversarial training when paired with weight averaging, with CutMix particularly effective.

  • Problem

    Adversarial training suffers from robust overfitting, while prior studies found data augmentation ineffective for adversarially robust models without additional data.

  • Method

    The paper combines common data augmentation techniques with model weight averaging and evaluates the resulting adversarially trained models.

  • Results

    +2.93% and +2.16% robust-accuracy improvements are obtained with CutMix on CIFAR-10 for ℓ∞ perturbations of size 8/255 and ℓ2 perturbations of size 128/255, respectively.

  • Takeaways & Limitations

    Combining data augmentation with model weight averaging can significantly improve robustness, including without external data and across other datasets and architectures.

  • Takeaways & Limitations

    For Pad & Crop, increasing the weight-averaging decay rate can reduce performance because degraded model iterations enter the ensemble; the best value is τ = 0.9925.

Abstract

from arXiv · show

Adversarial training suffers from robust overfitting, a phenomenon where the robust test accuracy starts to decrease during training. In this paper, we focus on reducing robust overfitting by using common data augmentation schemes. We demonstrate that, contrary to previous findings, when combined with model weight averaging, data augmentation can significantly boost robust accuracy. Furthermore, we compare various augmentations techniques and observe that spatial composition techniques work the best for adversarial training. Finally, we evaluate our approach on CIFAR-10 against $\ell_\infty$ and $\ell_2$ norm-bounded perturbations of size $ε= 8/255$ and $ε= 128/255$, respectively. We show large absolute improvements of +2.93% and +2.16% in robust accuracy compared to previous state-of-the-art methods. In particular, against $\ell_\infty$ norm-bounded perturbations of size $ε= 8/255$, our model reaches 60.07% robust accuracy without using any external data. We also achieve a significant performance boost with this approach while using other architectures and datasets such as CIFAR-100, SVHN and TinyImageNet.

1 Introduction

Adversarial training is highly effective but robust overfitting and prior failures of augmentation motivate combining data augmentation with model weight averaging. The approach improves robust accuracy without external data.

  • Adversarial training is the de facto standard for robust neural-network training, despite defenses often failing against different adversaries.
  • Prior studies found that additional data improved adversarial robustness, whereas data augmentation alone did not.
  • Combining Cutout, CutMix, and MixUp with model weight averaging can improve robustness.
  • +2.87% robust accuracy is reported over Gowal et al.'s 57.20% model without additional external data.

2 Related Work

Related work covers adversarial attacks, adversarial training defenses, and data augmentation, emphasizing the contrast between augmentation's standard-training benefits and its prior ineffectiveness for robust training.

  • Adversarial attacks progressed from FGSM to randomized and iterative gradient-based methods.
  • Adversarial training feeds perturbed examples into training and has been modified through attack procedures, loss functions, architectures, and TRADES.
  • Common and sophisticated augmentations improve standard generalization but were previously ineffective for adversarially robust networks.

3 Preliminaries and hypothesis

The paper formalizes adversarial training, characterizes robust overfitting, and hypothesizes that weight averaging helps more when robust accuracy remains stable across model iterations.

  • 3.1 Adversarial training: Adversarial training minimizes adversarial risk over model parameters against perturbations constrained by an allowed set.
  • 3.1 Adversarial training: PGD solves the inner adversarial optimization using cross-entropy loss and K projected gradient steps.
  • 3.2 Robust overfitting: Robust overfitting occurs when test robust accuracy degrades while train robust accuracy continues rising.
  • 3.3 Model weight averaging: Weight averaging uses an exponential moving average of model parameters and evaluates the averaged parameters.
  • 3.3 Model weight averaging: Weight averaging remains useful when external data removes visible robust overfitting, motivating the hypothesis that stable model iterations improve robustness.
  • 3.3 Model weight averaging: Ensembling model iterations can exploit diversity, but averaging degraded iterations creates a performance trade-off.

4 Data augmentations

The paper tests whether augmentation can preserve robust accuracy and thereby benefit from weight averaging. MixUp supports the hypothesis, while patch-based methods—especially CutMix—perform best.

  • 4 Data augmentations: Augmentations such as MixUp and Cutout can reduce robust overfitting without improving the best robust accuracy when used without weight averaging.
  • 4 Data augmentations: MixUp with weight averaging surpasses Pad & Crop, even though non-averaged MixUp has lower best robust accuracy.
  • 4 Data augmentations: The observed MixUp result demonstrates benefits of data augmentation for adversarial training, contrary to three recent publications.
  • 4 Data augmentations: The study evaluates Cutout, CutMix, RICAP, and SmoothMix as image-patching techniques, with additional AutoAugment and RandAugment analyses.
  • 4 Data augmentations: CutMix avoids robust overfitting, and its averaged model's robust accuracy continues increasing beyond the other augmentation methods.

5 Experimental setup

Experiments use WRN backbones with TRADES-based adversarial training, evaluate inner maximization with PGD, and assess robust accuracy using AA+MT. Figures compare augmentation methods and MixUp mixing rates, including the effect of weight averaging.

  • Architecture: WRN-28-10 is the main architecture, with 28 layers, width multiplier 10, and 36M parameters.The architecture uses Swish/SiLU activations and follows prior work's design details.
  • Outer minimization: TRADES is optimized with SGD and Nesterov momentum for 400 epochs, using batch size 512 and scheduled learning-rate decay.Training runs across 32 Google Cloud TPU v3 cores with global weight decay of 5 × 10^-4.
  • Inner minimization: Adversarial examples maximize KL divergence between clean and adversarial predictions using Adam for 10 PGD steps.The initial step size is 0.1 and decreases to 0.01 after five steps.
  • Data augmentation comparisons: Figure 4 compares clean and AA+MT robust accuracy across augmentation techniques, showing performance changes from weight averaging.The experiments use WRN-28-10 trained on CIFAR-10 against ϵ∞ = 8/255.
  • MixUp analysis: Figure 5 varies MixUp's mixing rate α and reports PGD40 robust accuracy without weight averaging alongside AA+MT accuracy after weight averaging.The evaluation uses CIFAR-10 with ϵ∞ = 8/255.
  • Evaluation protocol: Evaluation selects among two models per setting using a 1,024-sample validation set and reports robust test accuracy against AA+MT.Early stopping and model selection use PGD40 on the separate validation set.

6 Experimental results

Experiments show that model weight averaging makes several augmentations effective against adversarial attacks, with spatial composition methods generally outperforming MixUp. The gains persist across architectures, threat models, and datasets, while excessive averaging can incorporate degraded snapshots.

  • Weight averaging and model snapshots: Weight averaging benefits augmentation by ensembling snapshots that can have similar total robust accuracy but different individual predictions.For Pad & Crop, however, averaging too many degraded snapshots hurts performance; the best decay rate is τ = 0.9925.
  • Comparing data augmentations: CutMix, Cutout, and RICAP substantially improve robust accuracy with weight averaging, while MixUp provides only a small robust-accuracy gain.CutMix improves robust accuracy by +3.06% over Pad & Crop, whereas MixUp improves it by +0.91%.
  • Comparing data augmentations: MixUp’s robust accuracy decreases as α increases, with weight averaging performing best at α = 0.2.The best setting corresponds to blended images that remain close to the original images.
  • Comparing data augmentations: Spatial composition methods perform best with large patches, peaking at a window length of 20, unlike MixUp’s preference for mild blending.The paper hypothesizes that composition methods preserve low-level features locally, whereas MixUp can destroy them.
  • Generalizing to other architectures: +2.90% robust accuracy is the minimum CutMix gain across WideResNet sizes, compared with at least +1.76% for ResNet models.Both comparisons use the Pad & Crop baseline with weight averaging.
  • Generalizing to other threat models: +2.93% and +2.16% are the maximum robust-accuracy gains from CutMix under ℓ∞ and ℓ2 threat models, respectively.The evaluation uses CIFAR-10 with ε∞ = 8/255 and ε2 = 128/255.
  • Generalizing to other datasets: The approach also improves results on CIFAR-100, TinyImageNet, and SVHN, although CutMix helps SVHN less because its images contain multiple digits.On CIFAR-100, the best model reaches 32.43% against AutoAttack and improves the state of the art by +2.40% without external data.

7 Conclusion

The paper concludes that data augmentation can improve adversarial robustness when combined with model weight averaging, contrary to earlier negative findings. It attributes the benefit partly to effective ensembling of diverse model snapshots from the same training run.

  • Conclusion: Combining data augmentation with model weight averaging significantly improves adversarial robustness without requiring the earlier unsuccessful augmentation-only setup.The conclusion contrasts the approach with previous attempts using data augmentation without weight averaging.
  • Conclusion: Model snapshots can share similar total robust accuracy while differing substantially in individual predictions, enabling weight averaging to boost performance.The conclusion links this snapshot diversity to the effectiveness of ensembling.

A Analysis of models

The analysis tests whether the reported robustness reflects genuine resistance rather than gradient obfuscation. Multiple attack, radius, step-count, and loss-landscape diagnostics support that interpretation.

  • Attack diagnostics: AA+MT matches AUTOATTACK’s final robust accuracy, while SQUARE finds no additional adversarial examples.The authors interpret these results as evidence that their robustness measurement is meaningful and gradients are not obfuscated.
  • Attack diagnostics: Robust accuracy gradually drops as the AUTOPGD-CE perturbation radius increases from zero to 64/255.This indicates PGD-based attacks can find adversarial examples across increasing radii.
  • Attack diagnostics: Measured robust accuracy converges after 50 AUTOPGD-CE steps when evaluated at ϵ∞= 8/255.The authors report this as further indication that attacks converge in 100 steps.
  • Loss landscapes: The loss landscapes vary inputs toward a PGD40 worst perturbation and a random Rademacher direction using adversarial margin loss.The margin loss is zy − maxi̸=y zi, with misclassification occurring below zero.
  • Loss landscapes: The CIFAR-10 loss landscapes for the WRN-70-16 trained with CutMix are smooth and show no gradient-obfuscation patterns.This model obtains 60.07% robust accuracy, and the figures complement the numerical diagnostics.

B Analysis of augmentations

The augmentation analysis compares implementation choices and augmentation families for adversarial training. Spatial composition performs strongly, while curated RandAugment is complementary to CutMix.

  • Implementation: The study evaluates Pad & Crop, MixUp, and Cutout alongside additional AutoAugment and RandAugment variants.The implementation includes a 4-pixel pad-and-crop, Beta(α, α) mixing with α = 0.2 for MixUp, and 16-pixel Cutout windows.
  • Pipeline design: Applying augmentation before the adversarial attack performs significantly better than applying it afterward.Applying composition after the attack can destroy adversarial perturbations and reduce attack strength.
  • Pipeline design: The augmentation-aware training objective adapts TRADES by applying the loss to augmented inputs x′ and labels y′.The inner perturbation δ′ maximizes the KL-divergence term over the allowed perturbation set.
  • Augmentation families: AutoAugment policies learned for natural accuracy may not suit adversarial training, whereas RandAugment offers a smaller search space.RandAugment searches over transformation-sequence length N and global magnitude M, enabling faster adaptation.
  • Augmentation ablation: Invert, Posterize, and Solarize significantly hurt robustness relative to the median of tested transformations.Table 5 reports deltas in validation robust accuracy relative to median robust accuracies of 53.61% for M = 3 and 53.81% for M = 5.
  • Augmentation ablation: 56.51% robust accuracy is achieved by curated RandAugment with WA, improving +1.05% over the non-curated version but remaining worse than CutMix.Combining curated RandAugment with CutMix reaches 58.09%, an additional +0.59% over CutMix alone with WA.

C Additional data setting

With 500K images from 80M-TI, augmentation benefits depend on model capacity. CutMix improves the large WRN-70-16 but underperforms the baseline for the smaller WRN-28-10.

  • External-data evaluation: For WRN-28-10, CutMix performs worse than the baseline when 500K external images are added.The authors attribute this to insufficient model capacity to exploit all the additional data.
  • External-data evaluation: 66.56% ℓ∞ robust accuracy and 82.23% ℓ2 robust accuracy are achieved with CutMix using external data.These results improve upon Gowal et al. [20] by +0.68% in the ℓ∞ setting and +1.19% in the ℓ2 setting.
  • External-data evaluation: Table 6 reports clean and AA+MT robust accuracy for CIFAR-10 at ϵ∞= 8/255 and ϵ2 = 128/255 with added 80M-TI images.The comparison covers both perturbation norms in the external-data setting.

D Societal impact

The paper notes that improving robustness can introduce negative effects involving attack strength, model sensitivity and bias, and privacy risks.

  • Potential negative effects: Improved robustness can enable stronger adversarial images when attackers maximize the improved model’s error.The paper cites image synthesis work as an example of this concern.
  • Potential negative effects: Adversarial training can increase the influence of training points, reducing model sensitivity and leading to larger biases.This is presented as one possible reason robustness improvements may have negative impacts.
  • Potential negative effects: Improved robustness is reported to increase privacy-attack success and sensitivity to membership-inference attacks.The paper attributes these findings to Song et al. [46].
Loading 2111.05328v1…