Make Some Noise: Reliable and Efficient Single-Step Adversarial Training

• URL: http://arxiv.org/abs/2202.01181v1
• Date: Wed, 2 Feb 2022 18:10:01 GMT
• Title: Make Some Noise: Reliable and Efficient Single-Step Adversarial Training
• Abstract summary: We revisit the role of noise and clipping in single-step adversarial training. We find that using a stronger noise around the clean sample combined with not clipping is highly effective in avoiding CO for large perturbation radii.
• Score: 81.2112613657771
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Recently, Wong et al. showed that adversarial training with single-step FGSM leads to a characteristic failure mode named catastrophic overfitting (CO), in which a model becomes suddenly vulnerable to multi-step attacks. They showed that adding a random perturbation prior to FGSM (RS-FGSM) seemed to be sufficient to prevent CO. However, Andriushchenko and Flammarion observed that RS-FGSM still leads to CO for larger perturbations, and proposed an expensive regularizer (GradAlign) to avoid CO. In this work, we methodically revisit the role of noise and clipping in single-step adversarial training. Contrary to previous intuitions, we find that using a stronger noise around the clean sample combined with not clipping is highly effective in avoiding CO for large perturbation radii. Based on these observations, we then propose Noise-FGSM (N-FGSM) that, while providing the benefits of single-step adversarial training, does not suffer from CO. Empirical analyses on a large suite of experiments show that N-FGSM is able to match or surpass the performance of previous single-step methods while achieving a 3$\times$ speed-up.

Related papers

• Catastrophic Overfitting, Entropy Gap and Participation Ratio: A Noiseless $l^p$ Norm Solution for Fast Adversarial Training [6.393645655578601]
  We propose a novel solution that controls the $lp$ training norm to mitigate Catastrophic Overfitting (CO)<n>Our study is motivated by the empirical observation that CO is more prevalent under the $linfty$ norm than the $l2$ norm.<n>By quantifying gradient concentration through Participation Ratio and entropy measures, we develop an adaptive $lp$-FGSM that automatically tunes the training norm based on gradient information.
  arXiv  Detail & Related papers  (2025-05-05T04:41:21Z)
• Purify Unlearnable Examples via Rate-Constrained Variational Autoencoders [101.42201747763178]
  Unlearnable examples (UEs) seek to maximize testing error by making subtle modifications to training examples that are correctly labeled. Our work provides a novel disentanglement mechanism to build an efficient pre-training purification method.
  arXiv  Detail & Related papers  (2024-05-02T16:49:25Z)
• Catastrophic Overfitting: A Potential Blessing in Disguise [51.996943482875366]
  Fast Adversarial Training (FAT) has gained increasing attention within the research community owing to its efficacy in improving adversarial robustness. Although existing FAT approaches have made strides in mitigating CO, the ascent of adversarial robustness occurs with a non-negligible decline in classification accuracy on clean samples. We employ the feature activation differences between clean and adversarial examples to analyze the underlying causes of CO. We harness CO to achieve attack obfuscation', aiming to bolster model performance.
  arXiv  Detail & Related papers  (2024-02-28T10:01:44Z)
• An Efficient Rehearsal Scheme for Catastrophic Forgetting Mitigation during Multi-stage Fine-tuning [55.467047686093025]
  A common approach to alleviate such forgetting is to rehearse samples from prior tasks during fine-tuning. We propose a sampling scheme, textttbf mix-cd, that prioritizes rehearsal of collateral damage'' samples. Our approach is computationally efficient, easy to implement, and outperforms several leading continual learning methods in compute-constrained settings.
  arXiv  Detail & Related papers  (2024-02-12T22:32:12Z)
• Efficient local linearity regularization to overcome catastrophic overfitting [59.463867084204566]
  Catastrophic overfitting (CO) in single-step adversarial training results in abrupt drops in the adversarial test accuracy (even down to 0%) We introduce a regularization term, called ELLE, to mitigate CO effectively and efficiently in classical AT evaluations.
  arXiv  Detail & Related papers  (2024-01-21T22:55:26Z)
• Noise Augmentation Is All You Need For FGSM Fast Adversarial Training: Catastrophic Overfitting And Robust Overfitting Require Different Augmentation [72.87038663276554]
  Adversarial training (AT) and its variants are the most effective approaches for obtaining adversarially robust models. In this work, we show that single-step F GSMAT is not as hard as suggested in the past line of work: noise augmentation is all you need for (F GSM) fast AT.
  arXiv  Detail & Related papers  (2022-02-11T07:37:55Z)
• Sparse and Imperceptible Adversarial Attack via a Homotopy Algorithm [93.80082636284922]
  Sparse adversarial attacks can fool deep networks (DNNs) by only perturbing a few pixels. Recent efforts combine it with another l_infty perturbation on magnitudes. We propose a homotopy algorithm to tackle the sparsity and neural perturbation framework.
  arXiv  Detail & Related papers  (2021-06-10T20:11:36Z)
• Robust Single-step Adversarial Training with Regularizer [11.35007968593652]
  We propose a novel Fast Gradient Sign Method with PGD Regularization (FGSMPR) to boost the efficiency of adversarial training without catastrophic overfitting. Experiments demonstrate that our proposed method can train a robust deep network for L$_infty$-perturbations with FGSM adversarial training.
  arXiv  Detail & Related papers  (2021-02-05T19:07:10Z)
• Understanding Catastrophic Overfitting in Single-step Adversarial Training [9.560980936110234]
  "catastrophic overfitting" is a phenomenon in which the robust accuracy against projected gradient descent suddenly decreases to 0% after a few epochs. We propose a simple method that not only prevents catastrophic overfitting, but also overrides the belief that it is difficult to prevent multi-step adversarial attacks with single-step adversarial training.
  arXiv  Detail & Related papers  (2020-10-05T06:13:35Z)
• Understanding and Improving Fast Adversarial Training [27.666483899332643]
  A recent line of work focused on making adversarial training computationally efficient for deep learning models. We show that adding a random step to FGSM does not prevent catastrophic overfitting. We propose a new regularization method, GradAlign, that prevents catastrophic overfitting.
  arXiv  Detail & Related papers  (2020-07-06T10:16:43Z)
• Towards Rapid and Robust Adversarial Training with One-Step Attacks [0.0]
  Adversarial training is the most successful method for increasing the robustness of neural networks against adversarial attacks. We present two ideas that enable adversarial training with the computationally less expensive Fast Gradient Sign Method. We show that noise injection in conjunction with FGSM-based adversarial training achieves comparable results to adversarial training with PGD while being considerably faster.
  arXiv  Detail & Related papers  (2020-02-24T07:28:43Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.