Recent Advances in Adversarial Training for Adversarial Robustness

“Su et al. (2018) evaluated the recent SOTA ImageNet-based DNN models on multiple robustness metrics.”

“However, it is found [Andriushchenko and Flammarion, 2020] that the above fast training methods [Shafahi et al.”

“The adversarial counterpart x ′ of x is expressed as There are some common attacks following this formulation like Fast Gradient Sign Method (FGSM) [Goodfellow et al. , 2015], iterative FGSM [Kurakin et al. , 2016], and Projected Gradient Descent (PGD) attack [Madry et al. , 2018].”

“Current adversarial training methods [Madry et al. , 2018] can produce a robust model with worst-case accuracy of around 90% on MNIST.”

“(2020) empirically investigated various techniques like `1 and `2 regularization, cutout [DeVries and Taylor, 2017], mixup [Zhang et al., 2018] and early stopping, where early stopping is found to be the most effective.”

“, 2015], iterative FGSM [Kurakin et al., 2016], and Projected Gradient Descent (PGD) attack [Madry et al.”

“(2020) empirically investigated various techniques like `1 and `2 regularization, cutout [DeVries and Taylor, 2017], mixup [Zhang et al.”

“Kurakin et al. (2017) extended this FGSM-based regularization term by controlling the ratio of adversarial examples in batches so that it can scale up to ImageNet.”

“To enhance the model robustness, adversarial training (AT) [7], [8] methods have shown significant potential in defending against adversarial attacks.”

“Besides, adversarial learning of neural networks is another approach to find out the sample with a maximum error in the local region and substantially add them to the training dataset to improve the robustness of neural networks [25].”

“This leads to several strategies that impose certain penalties during training (Bai et al., 2021).”

“Since its conceptualization, numerous advancements have been proposed to improve both the effectiveness and efficiency of adversarial training [25].”

“However, it is important to note that this strategy has been demonstrated to be inconsistent in terms of overall accuracy improvement and may, in fact, result in performance reductions for the original models [19].”

“To bridge this gap, domain adaptation techniques, such as domain randomization [1] and adversarial training [18], have been proposed.”

“For deep neural networks, robust adversarial training has been used with success [38].”

“Facing the threat of adversarial attacks, we summarize related defense methods in adversarial training [1], image preprocessing [14, 16], and image restoration [3].”

“Adversarial learning faces similar limitations: it commits to a certain threat model (e.g., L ∞ with a certain budget), and provides robustness only against such attacks—but this protection does not generalize to others (e.g., L 2 , or a larger budget) (Hendrycks et al., 2021; Bai et al., 2021).”

“For a comprehensive review, we refer readers to Bai et al. (2021).”

“Adversarial Training (AT) is the most effective approach for improving the robustness of deep neural networks against small input perturbations (Bai et al., 2021; Kurakin et al., Proceedings of the 42 nd International Conference on Machine Learning , Vancouver, Canada.”

“Mathematically, adversarial training is formulated as a problem of maxima and minima, searching for the best solution to the worst-case optimization [28].”

“Adversarial training has been proven to be the effective method for mitigating adversarial attacks [2] and thus has received widespread attention in the research community.”

“Understanding the vulnerability of deep models against adversarial examples is a crucial area of research [Akhtar and Mian, 2018, Bai et al., 2021, Biggio et al., 2013, Goodfellow et al., 2014, Szegedy et al., 2013, Zhang et al., 2020].”

“These methods are based on techniques such as adversarial training [43], regularization [44] to better calibrate the learning process, and defensive distillation to create smaller models that are less sensitive to data variations [45].”

“The work of Bai et al. [25] summarises a few recent efficient adversarial training works.”

“…term δ ∗ i ∈ R n for each sample X i in the training set which maximizes the JS divergence [24] Like standard adversarial training methods [6], the feasible perturbation δ i is restricted to a small region controlled by ε since arbitrary perturbations may harm the model performance on…”

“A common single task strategy to defend against adversarial attacks is to leverage adversarial training [19, 35, 36].”

“In fact, these methods have been extensively studied and compared in the literature [15, 16, 10, 9, 17] and represent a natural starting point for investigating the trade-offs related to HPT that arise in the context of AT.”

“Bai et al [75] discuss on the possible variants of adversarial retraining.”

“While techniques such as weight decay [40], dropout [56], batch normalization [34], and stochastic depth [32] can be considered as “data independent" regularization schemes [25], popular “data dependent" regularization approaches include data augmentation [42, 12, 39, 71, 55] and adversarial training [24, 6].”

“Towards defense, adversarial training is the most widely used method to improve adversarial robustness [27, 2].”

“How can a dishonest model provider mislead the verifier into falsely believing that the model no longer retains any influence from the forgotten data?”

“An approach to do that is by training the NN in a way that the resulting model is robust to external attacks, by injecting attacked images into the training dataset [4].”

“Although there are many additional approaches to perform adversarial attacks or improve robustness [1,6,13,14,16,17,20,24,31], finding a proper representation of adversarial perturbations when it comes to NLP tasks is still an open question, due to its discrete features of the input data.”

“Adversarial training, widely known for its application in Generative Adversarial Networks (GANs) (Goodfellow et al., 2014) and adversarially robust deep learning (Bai et al., 2021), offers a general framework for learning in the face of complex data distributions.”

“Quantitative studies show that adversarial training increases model robustness by 40%–60% against PGD attacks while incurring 15%–25% additional training time [23, 101].”

“Robustness may be improved with adversarial training 47 to counter noise and distribution shifts.”

“Adversarial training (Bai et al., 2021) has shown promise in mitigating such vulnerabilities by introducing adversarial perturbations during training to improve model robustness.”

“However, a limitation of these techniques is that they primarily focus on addressing the effects of adversarial attacks, such as smoothing decision boundaries [19] or learning adversarial perturbation patterns [20].”

“On the other hand, critical evaluations suggest that adversarial training may promote more severe overfitting, leading to increased gaps between training and test accuracy, [2, 40].”

“Regarding robustness, methods like adversarial training [40] have been employed to enhance model resilience by intentionally introducing perturbations during training to improve defenses against adversarial attacks.”

“On the other hand, to defend against adversarial attacks, a widely adopted approach is AT, which has proven to be an effective method for enhancing adversarial robustness [26], [27].”

“Each sample has three channels and is resized to 48x48 as in the prior study [49].”

“Among various defense methods against adversarial examples [4]–[7], adversarial training has emerged as the most effective one for improving intrinsic network robustness via augmenting adversarial examples into training samples adaptively [3], [8]–[11].”

“Within the deep learning community, significant efforts have also been made to train models that are robust to small input perturbations, referred to as adversarial examples [41, 42, 43, 44].”

“The improvement from FGSM-AT [19] to FGSM-RS [17] and FGSM-MEP [15] shows the importance of perturbation initialization, which can alleviate the catastrophic overfitting and enhance model robustness [17], [46].”

“Adversarial training (AT) is a key defense against known attacks, enhancing the robustness of learning-based models by training them on adversarial datasets [38].”

“Adversarial robustness, detailed in [52], ensures model stability even when inputs are slightly altered.”

“It is well known that adversarial examples forged by adding small perturbations can reduce deep learning models’ classification accuracy [40] and that adversarial training is an effective approach to make models (at least partially) more robust to them [41].”

“Inspired by [27], the robustness of the control model is improved by adversarial training and SDAE under the FGSM attack.”

“However, structured prediction models are also susceptible to adversarial attacks, as demonstrated by various works [4, 12, 24, 25, 37, 38, 42].”

“A large amount of research has been done to develop effective adversarial attacks and corresponding defense algorithms [2, 3, 4].”

“I N MANY machine learning algorithms, small malicious perturbations that are imperceptible to the human eye can cause classifiers to reach erroneous conclusions [2], [3], [4].”

“In recent years, in order to overcome the adversarial attacks, adversarial defense methods usually concentrate on random smoothing [7], adversarial training [8], and Jacobian regularization [9].”

“However, adversarial training introduces a tradeoff between model performance and robustness [50], which may limit the performance of the speech-quality-enhancement network.”

“Adversarial training is one of the most effective defense approaches against adversarial attacks [7].”

“The topic was extensively studied by the research community, see [9]– [11].”

“Although recent studies [3, 25, 37, 38] attempted to mitigate the issues, their performances are still unsatisfactory.”

“Therefore, existing approaches, such as adversarial training [13] and preprocessing defenses [14], fail to handle the unique characteristics of laser-based perturbations, which are non-crafted, dynamic, and large-scale.”

“We could also employ adversarial training, where the model is trained on adversarial examples in addition to the original dataset, as an effective countermeasure [63], [64].”

“However, despite their impressive capabilities, DNNs are susceptible to various attack methods, which can lead to erroneous outputs [9].”

“Lastly, we employ adversarial training (Bai et al., 2021) to further enhance the model’s performance.”

“This technique can be employed as a defensive mechanism (adversarial training) to enhance the detection performance of ML classifiers (Bai et al., 2021).”

“Another well-known defense against adversarial attacks is Adversarial Training [13], [14] that improves robustness against these attacks by retraining with adversarial examples.”

“To enhance adversarial robustness, adversarial training remains prevalent, where adversarial examples are incorporated during training [4, 37, 49, 75, 84].”

“Among other defense strategies 19–24 , adversarial training is posed as an effective method to achieve robust and generalizable machine learning models 2,5,25,26 As a whole, our contribution is a general method that confers significant levels of robustness and natural accuracy upon classifiers.”

“…via a multi-objective optimization: where L KL denotes the Kullback-Leibler divergence, L MixUp (Zhang et al., 2018) to promote local linearity L LS label smoothing (M ¨ uller et al., 2019) to penalize overconfidence, and L Adv adversarial training (Bai et al., 2021) to enforce gradient stability.”

“Finally, adversarial training [25], [26] is a common strategy to improve model robustness against attacks.”

“If our scenario was less restrictive, then it would be trivial to adapt N AT GVD to iteratively refine adversarial code.”

“However, AT has inherent problems with computational overheads and robust generalization [4].”

“43 The discriminator deploys a multi-layer (CNN) structure finely tuned to discern image features.”

“More-over, the first stage of UniversalEPI could be enhanced by incorporating techniques such as adversarial training [ 83–85 ], which would additionally help prevent the model from capturing cell-type-specific information and improve its ability to generalize across cell types.”

“The former can be achieved by training on a wider distribution of data, often by incorporating noisy or attacked data [48]–[50].”

“Therefore, investigating adversarial attacks on DNN classifiers for 3D point clouds is essential for assessing and enhancing their robustness against such threats [5].”

“Adversarial training methods [6], [7] are popular for de-fending against adversarial examples and noisy inputs.”

“Adversarial training is another method which is studied to increase robustness of DNNs, however adversarial training often fails to perform well especially under various attack configurations (Bai et al., 2021).”

“The paper [27] discusses adversarial robustness, concluding that robustness in adversarially trained models is not guaranteed due to inadequate methods for solving non-convex min-max problems and due to severe overfitting, which is common in adversarial training.”