Adversarial Examples Improve Image Recognition

2019/11/21 by Cihang Xie, Xie, Cihang, Mingxing Tan +9 · 16 citations
Computer Science · #Advanced Neural Network Applications #Adversarial Robustness in Machine Learning #Computer Vision and Pattern Recognition (cs.CV) #FOS: Computer and information sciences #cs.CV

paper · pdf · doi:10.48550/arxiv.1911.09665

CVPR 2020, models are available at https://github.com/tensorflow/tpu/tree/master/models/official/efficientnet

openalex publication_date 2019/11/21 · arxiv created 2020/04/14 · arxiv updated 2020/04/15 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28

Abstract

Adversarial examples are commonly viewed as a threat to ConvNets. Here we present an opposite perspective: adversarial examples can be used to improve image recognition models if harnessed in the right manner. We propose AdvProp, an enhanced adversarial training scheme which treats adversarial examples as additional examples, to prevent overfitting. Key to our method is the usage of a separate auxiliary batch norm for adversarial examples, as they have different underlying distributions to normal examples. We show that AdvProp improves a wide range of models on various image recognition tasks and performs better when the models are bigger. For instance, by applying AdvProp to the latest EfficientNet-B7 [28] on ImageNet, we achieve significant improvements on ImageNet (+0.7%), ImageNet-C (+6.5%), ImageNet-A (+7.0%), Stylized-ImageNet (+4.8%). With an enhanced EfficientNet-B8, our method achieves the state-of-the-art 85.5% ImageNet top-1 accuracy without extra data. This result even surpasses the best model in [20] which is trained with 3.5B Instagram images (~3000X more than ImageNet) and ~9.4X more parameters. Models are available at https://github.com/tensorflow/tpu/tree/master/models/official/efficientnet.

Citations

• Batch Normalization: Accelerating Deep Network Training by Reducing Internal Covariate Shift
• ImageNet Large Scale Visual Recognition Challenge
• ImageNet classification with deep convolutional neural networks
• Improved Regularization of Convolutional Neural Networks with Cutout
• Benchmarking Neural Network Robustness to Common Corruptions and Surface Variations
• Robustness May Be at Odds with Accuracy
• Inductive Bias of Gradient Descent based Adversarial Training on Separable Data
• Improving Robustness Without Sacrificing Accuracy with Patch Gaussian Augmentation
• A Fourier Perspective on Model Robustness in Computer Vision
• Natural Adversarial Examples
• Self-training with Noisy Student improves ImageNet classification
• The Curious Case of Adversarially Robust Models: More Data Can Help, Double Descend, or Hurt Generalization
• Confidence-Calibrated Adversarial Training: Generalizing to Unseen Attacks

Cited by

• C-DIRA: Computationally Efficient Dynamic ROI Routing and Domain-Invariant Adversarial Learning for Lightweight Driver Behavior Recognition
• Ensuring Calibration Robustness in Split Conformal Prediction Under Adversarial Attacks
• Provable Repair of Deep Neural Network Defects by Preimage Synthesis and Property Refinement
• C-LEAD: Contrastive Learning for Enhanced Adversarial Defense
• ANNIE: Be Careful of Your Robots
• ETA: Energy-based Test-time Adaptation for Depth Completion
• Distribution-Specific Learning for Joint Salient and Camouflaged Object Detection
• ScoreAdv: Score-based Targeted Generation of Natural Adversarial Examples via Diffusion Models
• Concept-based Adversarial Attack: a Probabilistic Perspective
• Boosting Generative Adversarial Transferability with Self-supervised Vision Transformer Features
• On Feature Normalization and Data Augmentation
• Intriguing properties of adversarial training at scale
• Contrastive Learning with Adversarial Examples
• PRJ: Perception-Retrieval-Judgement for Generated Images
• Semantic Equivalent Adversarial Data Augmentation for Visual Question Answering
• Large-Scale Adversarial Training for Vision-and-Language Representation Learning
• MaxUp: A Simple Way to Improve Generalization of Neural Network Training

Related

• One Man's Trash is Another Man's Treasure: Resisting Adversarial Examples by Adversarial Examples
• Adversarial Machine Learning at Scale
• AdvJND: Generating Adversarial Examples with Just Noticeable Difference
• Rethinking Natural Adversarial Examples for Classification Models
• Natural Adversarial Examples