Skip to main content
SpringerLink
Log in

Enhancing Adversarial Training via Reweighting Optimization Trajectory

  • Conference paper
  • First Online:
Machine Learning and Knowledge Discovery in Databases: Research Track (ECML PKDD 2023)

Part of the book series: Lecture Notes in Computer Science ((LNAI,volume 14169))

  • 1324 Accesses

Abstract

Despite the fact that adversarial training has become the de facto method for improving the robustness of deep neural networks, it is well-known that vanilla adversarial training suffers from daunting robust overfitting, resulting in unsatisfactory robust generalization. A number of approaches have been proposed to address these drawbacks such as extra regularization, adversarial weights perturbation, and training with more data over the last few years. However, the robust generalization improvement is yet far from satisfactory. In this paper, we approach this challenge with a brand new perspective – refining historical optimization trajectories. We propose a new method named Weighted Optimization Trajectories (WOT) that leverages the optimization trajectories of adversarial training in time. We have conducted extensive experiments to demonstrate the effectiveness of WOT under various state-of-the-art adversarial attacks. Our results show that WOT integrates seamlessly with the existing adversarial training methods and consistently overcomes the robust overfitting issue, resulting in better adversarial robustness. For example, WOT boosts the robust accuracy of AT-PGD under AA-\(L_{\infty }\) attack by 1.53%–6.11% and meanwhile increases the clean accuracy by 0.55%–5.47% across SVHN, CIFAR-10, CIFAR-100, and Tiny-ImageNet datasets.

T. Huang, S, Liu and T. Chen—These authors contributed equally to this research.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 84.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 109.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Notes

  1. 1.

    Robust generalization refers to the gap between the adversarial accuracy of the training set and test set, following previous work [7, 43, 48].

  2. 2.

    Appendix can be found in  https://arxiv.org/pdf/2306.14275v2.pdf.

References

  1. Alayrac, J.B., Uesato, J., Huang, P.S., Fawzi, A., Stanforth, R., Kohli, P.: Are labels required for improving adversarial robustness?. In: Advances in Neural Information Processing Systems 32 (2019)

    Google Scholar 

  2. Andriushchenko, M., Croce, F., Flammarion, N., Hein, M.: Square attack: a query-efficient black-box adversarial attack via random search. In: Vedaldi, A., Bischof, H., Brox, T., Frahm, J.-M. (eds.) ECCV 2020. LNCS, vol. 12368, pp. 484–501. Springer, Cham (2020). https://doi.org/10.1007/978-3-030-58592-1_29

    Chapter  Google Scholar 

  3. Athalye, A., Carlini, N., Wagner, D.: Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. arXiv preprint arXiv:1802.00420 (2018)

  4. Balaji, Y., Goldstein, T., Hoffman, J.: Instance adaptive adversarial training: Improved accuracy tradeoffs in neural nets. arXiv preprint arXiv:1910.08051 (2019)

  5. Carlini, N., Wagner, D.: Towards evaluating the robustness of neural networks. In: 2017 IEEE Symposium on Security and Privacy (SP), pp. 39–57. IEEE (2017)

    Google Scholar 

  6. Carmon, Y., Raghunathan, A., Schmidt, L., Duchi, J.C., Liang, P.S.: Unlabeled data improves adversarial robustness. In: Advances in Neural Information Processing Systems 32 (2019)

    Google Scholar 

  7. Chen, T., Zhang, Z., Liu, S., Chang, S., Wang, Z.: Robust overfitting may be mitigated by properly learned smoothening. In: International Conference on Learning Representations (2020)

    Google Scholar 

  8. Chen, T., et al.: Sparsity winning twice: Better robust generaliztion from more efficient training. arXiv preprint arXiv:2202.09844 (2022)

  9. Cohen, J.M., Rosenfeld, E., Kolter, J.Z.: Certified adversarial robustness via randomized smoothing. arXiv preprint arXiv:1902.02918 (2019)

  10. Croce, F., Hein, M.: Minimally distorted adversarial examples with a fast adaptive boundary attack. In: International Conference on Machine Learning, pp. 2196–2205. PMLR (2020)

    Google Scholar 

  11. Croce, F., Hein, M.: Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In: International Conference on Machine Learning, pp. 2206–2216. PMLR (2020)

    Google Scholar 

  12. Deng, J., Dong, W., Socher, R., Li, L.J., Li, K., Fei-Fei, L.: Imagenet: a large-scale hierarchical image database. In: 2009 IEEE Conference on Computer Vision and Pattern Recognition, pp. 248–255. IEEE (2009)

    Google Scholar 

  13. Dong, Y., Pang, T., Su, H., Zhu, J.: Evading defenses to transferable adversarial examples by translation-invariant attacks. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 4312–4321 (2019)

    Google Scholar 

  14. Dong, Y., et al.: Exploring memorization in adversarial training. arXiv preprint arXiv:2106.01606 (2021)

  15. Dziugaite, G.K., Roy, D.M.: Computing nonvacuous generalization bounds for deep (stochastic) neural networks with many more parameters than training data. arXiv preprint arXiv:1703.11008 (2017)

  16. Elisseeff, A., Evgeniou, T., Pontil, M., Kaelbing, L.P.: Stability of randomized learning algorithms. J. Mach. Learn. Res. 6(1) (2005)

    Google Scholar 

  17. Engstrom, L., Ilyas, A., Athalye, A.: Evaluating and understanding the robustness of adversarial logit pairing. arXiv preprint arXiv:1807.10272 (2018)

  18. Foret, P., Kleiner, A., Mobahi, H., Neyshabur, B.: Sharpness-aware minimization for efficiently improving generalization. arXiv preprint arXiv:2010.01412 (2020)

  19. Girshick, R., Donahue, J., Darrell, T., Malik, J.: Rich feature hierarchies for accurate object detection and semantic segmentation. In: Proceedings of the IEEE Computer Society Conference on Computer Vision and Pattern Recognition (2014). https://doi.org/10.1109/CVPR.2014.81

  20. Goodfellow, I.J., Shlens, J., Szegedy, C.: Explaining and Harnessing Adversarial Examples (Dec 2014). arxiv.org/abs/1412.6572

  21. Hardt, M., Recht, B., Singer, Y.: Train faster, generalize better: Stability of stochastic gradient descent. In: International Conference on Machine Learning, pp. 1225–1234. PMLR (2016)

    Google Scholar 

  22. He, K., Zhang, X., Ren, S., Sun, J.: Deep residual learning for image recognition. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 770–778 (2016)

    Google Scholar 

  23. Hinton, G., et al.: Deep neural networks for acoustic modeling in speech recognition. IEEE Signal Process. Mag. (2012). https://doi.org/10.1109/MSP.2012.2205597

  24. Huang, T., Menkovski, V., Pei, Y., Pechenizkiy, M.: Bridging the performance gap between fgsm and pgd adversarial training. arXiv preprint arXiv:2011.05157 (2020)

  25. Huang, T., Menkovski, V., Pei, Y., Pechenizkiy, M.: Calibrated adversarial training. In: Asian Conference on Machine Learning, pp. 626–641. PMLR (2021)

    Google Scholar 

  26. Huang, T., Menkovski, V., Pei, Y., Wang, Y., Pechenizkiy, M.: Direction-aggregated attack for transferable adversarial examples. ACM J. Emerging Technol. Comput. Syst. (JETC) 18(3), 1–22 (2022)

    Google Scholar 

  27. Jiang, Y., Neyshabur, B., Mobahi, H., Krishnan, D., Bengio, S.: Fantastic generalization measures and where to find them. arXiv preprint arXiv:1912.02178 (2019)

  28. Krizhevsky, A., Nair, V., Hinton, G.: Cifar-10 (canadian institute for advanced research). https://www.cs.toronto.edu/~kriz/cifar.html (2010)

  29. Madry, A., Makelov, A., Schmidt, L., Tsipras, D., Vladu, A.: Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083 (2017)

  30. Madry, A., Makelov, A., Schmidt, L., Tsipras, D., Vladu, A.: Towards Deep Learning Models Resistant to Adversarial Attacks, arxiv.org/abs/1706.06083 (Jun 2017)

  31. Moosavi-Dezfooli, S.M., Fawzi, A., Frossard, P.: DeepFool: a simple and accurate method to fool deep neural networks. In: Proceedings of the IEEE Computer Society Conference on Computer Vision and Pattern Recognition, vol. 2016-Decem, pp. 2574–2582. IEEE Computer Society (Dec 2016). https://doi.org/10.1109/CVPR.2016.282

  32. Moosavi-Dezfooli, S.M., Fawzi, A., Uesato, J., Frossard, P.: Robustness via curvature regularization, and vice versa, arXiv: 1811.09716 (Nov 2018)

  33. Netzer, Y., Wang, T., Coates, A., Bissacco, A., Wu, B., Ng, A.Y.: Reading digits in natural images with unsupervised feature learning (2011)

    Google Scholar 

  34. Pang, T., Lin, M., Yang, X., Zhu, J., Yan, S.: Robustness and accuracy could be reconcilable by (proper) definition. arXiv preprint arXiv:2202.10103 (2022)

  35. Qin, C., et al.: Adversarial Robustness through Local Linearization, arXiv: 1907.02610 (Jul 2019) ’

  36. Rebuffi, S.A., Gowal, S., Calian, D.A., Stimberg, F., Wiles, O., Mann, T.: Fixing data augmentation to improve adversarial robustness. arXiv preprint arXiv:2103.01946 (2021)

  37. Rice, L., Wong, E., Kolter, Z.: Overfitting in adversarially robust deep learning. In: International Conference on Machine Learning, pp. 8093–8104. PMLR (2020)

    Google Scholar 

  38. Ross, A., Doshi-Velez, F.: Improving the adversarial robustness and interpretability of deep neural networks by regularizing their input gradients. In: Proceedings of the AAAI Conference on Artificial Intelligence, vol. 32 (2018)

    Google Scholar 

  39. Schmidt, L., Santurkar, S., Tsipras, D., Talwar, K., Madry, A.: Adversarially robust generalization requires more data. In: Advances in Neural Information Processing Systems, pp. 5014–5026 (2018)

    Google Scholar 

  40. Sehwag, V., et al.: Robust learning meets generative models: Can proxy distributions improve adversarial robustness? arXiv preprint arXiv:2104.09425 (2021)

  41. Simonyan, K., Zisserman, A.: Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv:1409.1556 (2014)

  42. Singla, V., Singla, S., Feizi, S., Jacobs, D.: Low curvature activations reduce overfitting in adversarial training. In: Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 16423–16433 (2021)

    Google Scholar 

  43. Stutz, D., Hein, M., Schiele, B.: Relating adversarially robust generalization to flat minima. In: Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 7807–7817 (2021)

    Google Scholar 

  44. Szegedy, C., et al.: Intriguing properties of neural networks, arXiv: 1312.6199 (dec 2013)

  45. Uesato, J., O’donoghue, B., Kohli, P., Oord, A.: Adversarial risk and the dangers of evaluating against weak attacks. In: International Conference on Machine Learning, pp. 5025–5034. PMLR (2018)

    Google Scholar 

  46. Wang, Y., Zou, D., Yi, J., Bailey, J., Ma, X., Gu, Q.: Improving adversarial robustness requires revisiting misclassified examples. In: International Conference on Learning Representations (2020)

    Google Scholar 

  47. Wu, D., Wang, Y., Xia, S.T.: Revisiting loss landscape for adversarial robustness. arXiv preprint arXiv:2004.05884 (2020)

  48. Wu, D., Xia, S.T., Wang, Y.: Adversarial weight perturbation helps robust generalization. In: Advances in Neural Information Processing Systems 33 (2020)

    Google Scholar 

  49. Xie, C., et al.: Improving transferability of adversarial examples with input diversity. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 2730–2739 (2019)

    Google Scholar 

  50. Yu, C., et al.: Robust weight perturbation for adversarial training (2021)

    Google Scholar 

  51. Zagoruyko, S., Komodakis, N.: Wide residual networks. arXiv preprint arXiv:1605.07146 (2016)

  52. Zhang, C., et al.: Musings on deep learning: Properties of sgd. Tech. rep, Center for Brains, Minds and Machines (CBMM) (2017)

    Google Scholar 

  53. Zhang, H., Yu, Y., Jiao, J., Xing, E., El Ghaoui, L., Jordan, M.: Theoretically principled trade-off between robustness and accuracy. In: International Conference on Machine Learning, pp. 7472–7482. PMLR (2019)

    Google Scholar 

  54. Zhang, J., et a;.: Attacks which do not kill training make adversarial learning stronger. In: International Conference on Machine Learning, pp. 11278–11287. PMLR (2020)

    Google Scholar 

  55. Zhang, J., Zhu, J., Niu, G., Han, B., Sugiyama, M., Kankanhalli, M.: Geometry-aware instance-reweighted adversarial training. arXiv preprint arXiv:2010.01736 (2020)

  56. Zhou, Y., Liang, Y., Zhang, H.: Generalization error bounds with probabilistic guarantee for sgd in nonconvex optimization. arXiv preprint arXiv:1802.06903 (2018)

Download references

Acknowledgement

This work is partially supported by NWO EDIC and EDF KOIOS projects. Part of this work used the Dutch national e-infrastructure with the support of the SURF Cooperative using grant no. NWO2021.060, EINF-5587 and EINF-5587/L1. We would like to express our deepest gratitude to the anonymous reviewers whose insightful comments and suggestions significantly improved the quality of this paper.

Author information

Authors and Affiliations

  1. Eindhoven University of Technology, Eindhoven, The Netherlands

    Tianjin Huang, Meng Fang, Vlado Menkovski, Lu Yin, Yulong Pei & Mykola Pechenizkiy

  2. University of Texas at Austin, Austin, USA

    Shiwei Liu & Tianlong Chen

  3. University of Liverpool, Liverpool, UK

    Meng Fang

  4. JD Explore Academy, Beijing, China

    Li Shen

Authors
  1. Tianjin Huang
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Shiwei Liu
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Tianlong Chen
    View author publications

    You can also search for this author in PubMed Google Scholar

  4. Meng Fang
    View author publications

    You can also search for this author in PubMed Google Scholar

  5. Li Shen
    View author publications

    You can also search for this author in PubMed Google Scholar

  6. Vlado Menkovski
    View author publications

    You can also search for this author in PubMed Google Scholar

  7. Lu Yin
    View author publications

    You can also search for this author in PubMed Google Scholar

  8. Yulong Pei
    View author publications

    You can also search for this author in PubMed Google Scholar

  9. Mykola Pechenizkiy
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Tianjin Huang .

Editor information

Editors and Affiliations

  1. University of Michigan, Ann Arbor, MI, USA

    Danai Koutra

  2. University of Vienna, Vienna, Austria

    Claudia Plant

  3. Max Planck Institute for Software Systems, Kaiserslautern, Germany

    Manuel Gomez Rodriguez

  4. Politecnico di Torino, Turin, Italy

    Elena Baralis

  5. CENTAI, Turin, Italy

    Francesco Bonchi

Ethics declarations

Ethical statement

Our proposed method, Weighted Optimization Trajectories (WOT), enhances the robustness of deep neural networks against adversarial attacks. While the primary goal is to improve AI system security, it is crucial to consider the ethical implications of our work:

− Personal Data Protection: Researchers and practitioners must ensure proper data handling, privacy, and compliance with data protection laws when working with personal data

− Privacy Preservation: Improved robustness could inadvertently increase the capacity to infer personal information from data. Privacy-preserving techniques, like differential privacy, should be employed to mitigate these risks.

Rights and permissions

Reprints and permissions

Copyright information

© 2023 The Author(s), under exclusive license to Springer Nature Switzerland AG

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Huang, T. et al. (2023). Enhancing Adversarial Training via Reweighting Optimization Trajectory. In: Koutra, D., Plant, C., Gomez Rodriguez, M., Baralis, E., Bonchi, F. (eds) Machine Learning and Knowledge Discovery in Databases: Research Track. ECML PKDD 2023. Lecture Notes in Computer Science(), vol 14169. Springer, Cham. https://doi.org/10.1007/978-3-031-43412-9_7

Download citation

  • DOI: https://doi.org/10.1007/978-3-031-43412-9_7

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-031-43411-2

  • Online ISBN: 978-3-031-43412-9

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Societies and partnerships

Search

Navigation