Source-linked AI summary
LAS-AT: Adversarial Training with Learnable Attack Strategy
Xiaojun Jia, Yong Zhang, Baoyuan Wu, Ke Ma, Jue Wang, Xiaochun Cao
TL;DR
Adversarial training depends on inner adversarial-example generation, yet prior approaches commonly rely on fixed or hand-crafted attack strategies whose flexibility and robustness gains are limited. LAS-AT learns sample-dependent strategies with a strategy network competing against a target network, and experiments on three benchmark databases demonstrate the method’s superiority.
Problem
Prior adversarial-training methods commonly use fixed or hand-crafted attack strategies, while multi-stage alternatives require domain expertise and yield limited robustness improvement.
Method
LAS-AT jointly uses a target network for adversarial training and a strategy network that automatically generates sample-dependent attack strategies.
Results
Experiments on three benchmark databases demonstrate the superiority of LAS-AT.
Takeaways & Limitations
LAS-AT provides a learnable alternative to manually designed attack strategies for adversarial-example generation.
Takeaways & Limitations
Adversarial-example generation and attack operations such as choosing iteration times are non-differentiable, obstructing direct gradient backpropagation to the strategy network.
Abstract
from arXiv · showhide
Adversarial training (AT) is always formulated as a minimax problem, of which the performance depends on the inner optimization that involves the generation of adversarial examples (AEs). Most previous methods adopt Projected Gradient Decent (PGD) with manually specifying attack parameters for AE generation. A combination of the attack parameters can be referred to as an attack strategy. Several works have revealed that using a fixed attack strategy to generate AEs during the whole training phase limits the model robustness and propose to exploit different attack strategies at different training stages to improve robustness. But those multi-stage hand-crafted attack strategies need much domain expertise, and the robustness improvement is limited. In this paper, we propose a novel framework for adversarial training by introducing the concept of "learnable attack strategy", dubbed LAS-AT, which learns to automatically produce attack strategies to improve the model robustness. Our framework is composed of a target network that uses AEs for training to improve robustness and a strategy network that produces attack strategies to control the AE generation. Experimental evaluations on three benchmark databases demonstrate the superiority of the proposed method. The code is released at https://github.com/jiaxiaojunQAQ/LAS-AT.
1. Introduction
Adversarial training improves robustness by training with adversarial examples, but fixed or hand-crafted attack strategies limit flexibility and robustness gains. LAS-AT learns sample-dependent attack strategies through a strategy network that competes with a target network during training.
- Adversarial training improves adversarial robustness by injecting adversarial examples into training through a minimax formulation.
- Most existing methods manually specify attack parameters, such as PGD maximal perturbation 8, 10 iterations, and step size 2.
- Hand-crafted strategies lack flexibility and may limit generalization, while multi-stage strategies require domain expertise and provide limited robustness improvement.
- LAS-AT uses a strategy network to automatically produce sample-dependent attack strategies instead of hand-crafted strategies.
- LAS-AT combines a target network trained with adversarial examples and a strategy network that controls adversarial-example generation.
- The target network minimizes adversarial-example training loss while the strategy network maximizes it, enabling stronger attacks as target robustness improves.
2. Related Work
Related work established adversarial attacks and adversarial training as central tools for evaluating and improving robustness. Standard adversarial training uses a minimax objective whose inner maximization generates perturbations, while many methods retain fixed attack strategies.
- Adversarial Attack Methods: FGSM generates adversarial examples using model gradients, while PGD extends FGSM to a multi-step attack.
- Adversarial Training Defense Methods: Adversarial training improves robustness by using adversarial examples for training and is commonly formulated as a minimax optimization problem.
- Adversarial Training Defense Methods: In the standard objective, D is the data distribution, Ω is the perturbation set, x is the example, and y is its label.
- Adversarial Training Defense Methods: The perturbation δ represents an indistinguishable perturbation, while f_w is the target network and L(f_w(x), y) is its loss function.
- Adversarial Training Defense Methods: The inner maximization guides adversarial-example creation, but several reviewed adversarial-training methods use a fixed attack strategy throughout training.
3. The Proposed Approach
LAS-AT replaces fixed, hand-crafted attack strategies with learnable, sample-dependent strategies generated by a strategy network. Its target and strategy networks are optimized competitively, with loss terms measuring robustness and clean-sample performance.
- 3.1. Pipeline of the Proposed Framework: LAS-AT uses a target network for robust training and a strategy network that generates attack strategies for adversarial-example creation.The two networks compete: the target network defends against generated adversarial examples, while the strategy network improves attacks.
- 3.1. Pipeline of the Proposed Framework: The strategy network maps each sample to a distribution over attack strategies, whose parameters specify how the PGD attack is performed.Strategies are sample-dependent and can vary for the same sample as target-network robustness changes during training.
- 3.2. Novel Formulation of Adversarial Training: Unlike standard adversarial training, LAS-AT makes adversarial-example generation depend on strategy-network parameters rather than a fixed hand-crafted strategy.This makes the training objective a function of both target-network and strategy-network parameters.
- 3.2. Novel Formulation of Adversarial Training: The minimax game progressively requires stronger attacks as the target network becomes more robust, while allowing weak and strong attacks to succeed early in training.The strategy network learns attack strategies according to the target model and given samples at different training stages.
- 3.3. The Proposed Loss Terms: LAS-AT evaluates strategies using the robustness and clean-sample performance of a one-step-updated target network, combining the losses with trade-off weights α and β.The robustness term uses adversarial examples from another strategy, while the clean-sample term favors lower clean-example loss.
- 3.4. Optimization: Because adversarial-example generation and attack choices are nondifferentiable, LAS-AT uses REINFORCE and alternates strategy-network and target-network updates.The target network is updated every k strategy-network updates; the method also provides a stationary-point convergence result under stated assumptions.
4. Experiments
Experiments evaluate LAS-AT across datasets, attack settings, baseline methods, hyper-parameter choices, and ablations. Results show robustness gains, complementary loss effects, and automatically evolving attack strength during training.
- Settings: Experiments cover CIFAR-10, CIFAR-100, and Tiny ImageNet using multiple target architectures and adversarial-training baselines.Evaluation uses robust and clean accuracy under PGD, C&W, and Auto Attack settings.
- Comparisons with state-of-the-art robustness model: LAS-AWP achieves higher robustness than state-of-the-art robustness models on CIFAR-10 and CIFAR-100 without additional real or synthetic data.The comparisons use WRN-70-16 on CIFAR-10 and WRN-34-20 on CIFAR-100.
- Ablation Study: Combining the robustness loss L2 and clean-sample loss L3 achieves the best robustness and clean accuracy in the ablation study.L2 contributes more to robustness, whereas L3 contributes more to clean accuracy; using either alone introduces a corresponding trade-off.
- Performance Analysis: LAS-AT outperforms dynamic hand-crafted attack strategies and hyper-parameter search methods under all reported attack scenarios.The hyper-parameter comparison includes random search, OHL, and AdvHP; the hand-crafted comparison includes CAT, DART, and FAT.
- Performance Analysis: The learned perturbation-strength distribution shifts from broad diversity early in training toward several larger values at later stages.This produces diverse AEs while the target network is vulnerable and progressively stronger AEs as robustness improves.
5. Conclusion and Discussion
LAS-AT introduces learnable attack strategies through a target network and strategy network that jointly support adversarial example generation and robust training. Experiments on three benchmark databases demonstrate the method’s superiority.
- LAS-AT uses a target network and a strategy network as competing components in adversarial training.The target network trains on adversarial examples, while the strategy network produces attack strategies for their generation.
- The strategy network learns dynamic, sample-dependent attack strategies based on the target model’s robustness instead of using hand-crafted strategies.Two additional loss terms guide robustness evaluation and clean-sample prediction.
- Extensive experiments on three benchmark databases demonstrate the superiority of the proposed method.