On the Convergence and Robustness of Adversarial Training

2021/12/15 by Yisen Wang, Wang, Yisen, Xingjun Ma +9 · 183 citations
Computer Science · Engineering · Mathematics · #Advanced Neural Network Applications #Adversarial Robustness in Machine Learning #Adversarial system #Artificial intelligence #Artificial neural network #Computer science #Convergence (economics) #Deep neural networks #FOS: Computer and information sciences #Integrated Circuits and Semiconductor Failure Analysis #Machine Learning (cs.LG) #Machine learning #Mathematical optimization #Mathematics #Maximization #Minification #Robustness (evolution) #cs.LG

paper · pdf · doi:10.48550/arxiv.2112.08304

published in arXiv (Cornell University) (Cornell University) · ICML 2019 Long Talk. Fixing bugs in the proof of Theorem 1

openalex publication_date 2021/12/15 · arxiv created 2022/04/23 · arxiv updated 2022/04/26 · openalex created_date 2025/10/10 · openalex updated_date 2026/08/05

Abstract

Improving the robustness of deep neural networks (DNNs) to adversarial examples is an important yet challenging problem for secure deep learning. Across existing defense techniques, adversarial training with Projected Gradient Decent (PGD) is amongst the most effective. Adversarial training solves a min-max optimization problem, with the inner maximization generating adversarial examples by maximizing the classification loss, and the outer minimization finding model parameters by minimizing the loss on adversarial examples generated from the inner maximization. A criterion that measures how well the inner maximization is solved is therefore crucial for adversarial training. In this paper, we propose such a criterion, namely First-Order Stationary Condition for constrained optimization (FOSC), to quantitatively evaluate the convergence quality of adversarial examples found in the inner maximization. With FOSC, we find that to ensure better robustness, it is essential to use adversarial examples with better convergence quality at the later stages of training. Yet at the early stages, high convergence quality adversarial examples are not necessary and may even lead to poor robustness. Based on these observations, we propose a dynamic training strategy to gradually increase the convergence quality of the generated adversarial examples, which significantly improves the robustness of adversarial training. Our theoretical and empirical results show the effectiveness of the proposed method.

Citations

• On Estimation of a Probability Density Function and Mode
• Countering Adversarial Images using Input Transformations
• Certifying Some Distributional Robustness with Principled Adversarial Training
• Improving the Adversarial Robustness and Interpretability of Deep Neural Networks by Regularizing their Input Gradients

Cited by

• T-ADD: Enhancing DOA Estimation Robustness Against Adversarial Attacks
• On the Tension Between Optimality and Adversarial Robustness in Policy Optimization
• Superpixel Attack: Enhancing Black-box Adversarial Attack with Image-driven Division Areas
• Generalist++: A Meta-learning Framework for Mitigating Trade-off in Adversarial Training
• InfiAgent: Self-Evolving Pyramid Agent Framework for Infinite Scenarios
• Optimal Robust Recourse with L^p-Bounded Model Change
• DAC-LoRA: Dynamic Adversarial Curriculum for Efficient and Robust Few-Shot Adaptation
• Robustness Feature Adapter for Efficient Adversarial Training
• On the Escaping Efficiency of Distributed Adversarial Training Algorithms
• DuPO: Enabling Reliable LLM Self-Verification via Dual Preference Optimization
• Do Wider Neural Networks Really Help Adversarial Robustness?
• An Integrated Approach to Produce Robust Models with High Efficiency
• Adversarially Robust Estimate and Risk Analysis in Linear Regression
• Provably Efficient Black-Box Action Poisoning Attacks Against Reinforcement Learning
• CIFS: Improving Adversarial Robustness of CNNs via Channel-wise Importance-based Feature Selection
• Convergence of Adversarial Training in Overparametrized Neural Networks
• Multi-objective Search of Robust Neural Architectures against Multiple Types of Adversarial Attacks
• Dual Head Adversarial Training
• Boosting Adversarial Training with Hypersphere Embedding
• Reliable Adversarial Distillation with Unreliable Teachers
• Bridging the Performance Gap between FGSM and PGD Adversarial Training
• Towards Better Generalization via Distributional Input Projection Network
• X-Transfer Attacks: Towards Super Transferable Adversarial Attacks on CLIP
• Identifying and Understanding Cross-Class Features in Adversarial Training
• How Do Diffusion Models Improve Adversarial Robustness?
• GANs May Have No Nash Equilibria
• Continuous-Time Analysis of Heavy Ball Momentum in Min-Max Games
• What Can Style Transfer and Paintings Do For Model Robustness?
• ATRAS: Adversarially Trained Robust Architecture Search
• Clustering Effect of (Linearized) Adversarial Robust Models
• Model-Agnostic Defense for Lane Detection against Adversarial Attack
• Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networks
• Improving White-box Robustness of Pre-processing Defenses via Joint Adversarial Training
• Adversarial Camouflage: Hiding Physical-World Attacks with Natural Styles
• Evaluating the Robustness of Geometry-Aware Instance-Reweighted Adversarial Training
• On the Generalization Properties of Adversarial Training
• Adversarial Interaction Attack: Fooling AI to Misinterpret Human Intentions
• Amata: An Annealing Mechanism for Adversarial Training Acceleration
• How to Enhance Downstream Adversarial Robustness (almost) without Touching the Pre-Trained Foundation Model?

Related

• Improving the affordability of robustness training for DNNs
• Fast Training of Deep Neural Networks Robust to Adversarial Perturbations
• Understanding and Increasing Efficiency of Frank-Wolfe Adversarial Training
• Robust Deep Learning as Optimal Control: Insights and Convergence Guarantees
• Improved Adversarial Training via Learned Optimizer