2021/05/06 by Pei‐Lin Kang, Peilin Kang, Seyed-Mohsen Moosavi-Dezfooli +2
Computer Science · Engineering · Materials Science · #Adversarial Robustness in Machine Learning #Computer Vision and Pattern Recognition (cs.CV) #FOS: Computer and information sciences #High-Velocity Impact and Material Behavior #Integrated Circuits and Semiconductor Failure Analysis #Machine Learning (cs.LG) #cs.CV #cs.LG
paper · pdf · doi:10.48550/arxiv.2105.02942
arxiv created 2021/05/06 · openalex publication_date 2021/05/06 · arxiv updated 2021/05/10 · openalex created_date 2025/10/10 · openalex updated_date 2026/08/01
Recently, FGSM adversarial training is found to be able to train a robust model which is comparable to the one trained by PGD but an order of magnitude faster. However, there is a failure mode called catastrophic overfitting (CO) that the classifier loses its robustness suddenly during the training and hardly recovers by itself. In this paper, we find CO is not only limited to FGSM, but also happens in DF∞-1 adversarial training. Then, we analyze the geometric properties for both FGSM and DF∞-1 and find they have totally different decision boundaries after CO. For FGSM, a new decision boundary is generated along the direction of perturbation and makes the small perturbation more effective than the large one. While for DF∞-1, there is no new decision boundary generated along the direction of perturbation, instead the perturbation generated by DF∞-1 becomes smaller after CO and thus loses its effectiveness. We also experimentally analyze three hypotheses on potential factors causing CO. And then based on the empirical analysis, we modify the RS-FGSM by not projecting perturbation back to the l_∞ ball. By this small modification, we could achieve 47.56 ± 0.37% PGD-50-10 accuracy on CIFAR10 with ε=8/255 in contrast to 43.57 ± 0.30% by RS-FGSM and also further extend the working range of ε from 8/255 to 11/255 on CIFAR10 without CO occurring.