Understanding and Improving Fast Adversarial Training

• URL: http://arxiv.org/abs/2007.02617v2
• Date: Sat, 24 Oct 2020 11:20:16 GMT
• Title: Understanding and Improving Fast Adversarial Training
• Abstract summary: A recent line of work focused on making adversarial training computationally efficient for deep learning models. We show that adding a random step to FGSM does not prevent catastrophic overfitting. We propose a new regularization method, GradAlign, that prevents catastrophic overfitting.
• Score: 27.666483899332643
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: A recent line of work focused on making adversarial training computationally efficient for deep learning models. In particular, Wong et al. (2020) showed that $\ell_\infty$-adversarial training with fast gradient sign method (FGSM) can fail due to a phenomenon called "catastrophic overfitting", when the model quickly loses its robustness over a single epoch of training. We show that adding a random step to FGSM, as proposed in Wong et al. (2020), does not prevent catastrophic overfitting, and that randomness is not important per se -- its main role being simply to reduce the magnitude of the perturbation. Moreover, we show that catastrophic overfitting is not inherent to deep and overparametrized networks, but can occur in a single-layer convolutional network with a few filters. In an extreme case, even a single filter can make the network highly non-linear locally, which is the main reason why FGSM training fails. Based on this observation, we propose a new regularization method, GradAlign, that prevents catastrophic overfitting by explicitly maximizing the gradient alignment inside the perturbation set and improves the quality of the FGSM solution. As a result, GradAlign allows to successfully apply FGSM training also for larger $\ell_\infty$-perturbations and reduce the gap to multi-step adversarial training. The code of our experiments is available at https://github.com/tml-epfl/understanding-fast-adv-training.

Related papers

• Slimmable Networks for Contrastive Self-supervised Learning [69.9454691873866]
  Self-supervised learning makes significant progress in pre-training large models, but struggles with small models. We introduce another one-stage solution to obtain pre-trained small models without the need for extra teachers. A slimmable network consists of a full network and several weight-sharing sub-networks, which can be pre-trained once to obtain various networks.
  arXiv  Detail & Related papers  (2022-09-30T15:15:05Z)
• Bag of Tricks for FGSM Adversarial Training [30.25966570584856]
  Adversarial training (AT) with samples generated by Fast Gradient Sign Method (FGSM), also known as FGSM-AT, is a computationally simple method to train robust networks. During its training procedure, an unstable mode of "catastrophic overfitting" has been identified in arXiv:2001.03994 [cs.LG], where the robust accuracy abruptly drops to zero within a single training step. In this work, we provide the first study, which thoroughly examines a collection of tricks to overcome the catastrophic overfitting in FGSM-AT.
  arXiv  Detail & Related papers  (2022-09-06T17:53:21Z)
• Fast Adversarial Training with Adaptive Step Size [62.37203478589929]
  We study the phenomenon from the perspective of training instances. We propose a simple but effective method, Adversarial Training with Adaptive Step size (ATAS) ATAS learns an instancewise adaptive step size that is inversely proportional to its gradient norm.
  arXiv  Detail & Related papers  (2022-06-06T08:20:07Z)
• Noise Augmentation Is All You Need For FGSM Fast Adversarial Training: Catastrophic Overfitting And Robust Overfitting Require Different Augmentation [72.87038663276554]
  Adversarial training (AT) and its variants are the most effective approaches for obtaining adversarially robust models. In this work, we show that single-step F GSMAT is not as hard as suggested in the past line of work: noise augmentation is all you need for (F GSM) fast AT.
  arXiv  Detail & Related papers  (2022-02-11T07:37:55Z)
• Local Linearity and Double Descent in Catastrophic Overfitting [0.0]
  Catastrophic overfitting is a phenomenon observed during Adversarial Training (AT) with the Fast Gradient Sign Method (FGSM) We show that maintaining high local linearity might be $textitsufficient$ to prevent catastrophic overfitting but is not $textitnecessary.
  arXiv  Detail & Related papers  (2021-11-21T07:11:21Z)
• ZeroGrad : Mitigating and Explaining Catastrophic Overfitting in FGSM Adversarial Training [1.3124513975412255]
  We propose to zero the input gradient elements that are small for crafting FGSM attacks. Our proposed idea, while being simple and efficient, achieves competitive adversarial accuracy on various datasets.
  arXiv  Detail & Related papers  (2021-03-29T10:19:35Z)
• Robust Single-step Adversarial Training with Regularizer [11.35007968593652]
  We propose a novel Fast Gradient Sign Method with PGD Regularization (FGSMPR) to boost the efficiency of adversarial training without catastrophic overfitting. Experiments demonstrate that our proposed method can train a robust deep network for L$_infty$-perturbations with FGSM adversarial training.
  arXiv  Detail & Related papers  (2021-02-05T19:07:10Z)
• Initializing Perturbations in Multiple Directions for Fast Adversarial Training [1.8638865257327277]
  In image classification, an adversarial example can fool the well trained deep neural networks by adding barely imperceptible perturbations to clean images. Adversarial Training, one of the most direct and effective methods, minimizes the losses of perturbed-data. We propose the Diversified Initialized Perturbations Adversarial Training (DIP-FAT)
  arXiv  Detail & Related papers  (2020-05-15T15:52:33Z)
• Overfitting in adversarially robust deep learning [86.11788847990783]
  We show that overfitting to the training set does in fact harm robust performance to a very large degree in adversarially robust training. We also show that effects such as the double descent curve do still occur in adversarially trained models, yet fail to explain the observed overfitting.
  arXiv  Detail & Related papers  (2020-02-26T15:40:50Z)
• Do We Need Zero Training Loss After Achieving Zero Training Error? [76.44358201918156]
  We propose a direct solution called emphflooding that intentionally prevents further reduction of the training loss when it reaches a reasonably small value. We experimentally show that flooding improves performance and, as a byproduct, induces a double descent curve of the test loss.
  arXiv  Detail & Related papers  (2020-02-20T12:50:49Z)
• Fast is better than free: Revisiting adversarial training [86.11788847990783]
  We show that it is possible to train empirically robust models using a much weaker and cheaper adversary. We identify a failure mode referred to as "catastrophic overfitting" which may have caused previous attempts to use FGSM adversarial training to fail.
  arXiv  Detail & Related papers  (2020-01-12T20:30:22Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.