Revisiting and Advancing Fast Adversarial Training Through The Lens of Bi-Level Optimization
Revisiting and Advancing Fast Adversarial Training Through The Lens of Bi-Level Optimization
复制标题
DOI：
--
复制
发表时间：
2021-12
期刊：
影响因子：
--
通讯作者：
Yihua Zhang;Guanhua Zhang;Prashant Khanduri;Min-Fong Hong;Shiyu Chang;Sijia Liu
中科院分区：
文献类型：
--
作者：
Yihua Zhang;Guanhua Zhang;Prashant Khanduri;Min-Fong Hong;Shiyu Chang;Sijia Liu
对抗性训练（AT）是一种被广泛认可的防御机制，用于增强深度神经网络对对抗性攻击的鲁棒性。它建立在最小-最大优化（MMO）的基础上，其中最小化器（即，Defender）寻求一种鲁棒模型以在存在由最大化者制作的对抗性示例的情况下最小化最坏情况的训练损失（即，攻击者）。然而，传统的MMO方法使得AT难以扩展。因此，Fast-AT（Wong等人，2020）和其他最近的算法试图通过用基于单个梯度符号的攻击生成步骤替换其最大化步骤来简化MMO。虽然易于实现，但Fast-AT缺乏理论保证，并且由于在与强大对手一起训练时存在鲁棒灾难性过拟合问题，其经验性能不令人满意。在本文中，我们提出了快速AT从双层优化（BLO）的新视角。我们首先表明，常用的快速AT是等效的使用随机梯度算法来解决一个线性化的BLO问题，涉及一个符号操作。然而，符号运算的离散性质使得很难理解算法的性能。受BLO的启发，我们设计和分析了一组新的鲁棒训练算法，称为快速双层AT（Fast-BAT），它有效地防御基于符号的投影梯度下降（PGD）攻击，而不使用任何梯度符号方法或显式鲁棒正则化。在实践中，我们证明了我们的方法在多个模型和数据集的基线上产生了实质性的鲁棒性改进。代码可在https://github.com/OPTML-Group/Fast-BAT上获得。
Adversarial training (AT) is a widely recognized defense mechanism to gain the robustness of deep neural networks against adversarial attacks. It is built on min-max optimization (MMO), where the minimizer (i.e., defender) seeks a robust model to minimize the worst-case training loss in the presence of adversarial examples crafted by the maximizer (i.e., attacker). However, the conventional MMO method makes AT hard to scale. Thus, Fast-AT (Wong et al., 2020) and other recent algorithms attempt to simplify MMO by replacing its maximization step with the single gradient sign-based attack generation step. Although easy to implement, Fast-AT lacks theoretical guarantees, and its empirical performance is unsatisfactory due to the issue of robust catastrophic overfitting when training with strong adversaries. In this paper, we advance Fast-AT from the fresh perspective of bi-level optimization (BLO). We first show that the commonly-used Fast-AT is equivalent to using a stochastic gradient algorithm to solve a linearized BLO problem involving a sign operation. However, the discrete nature of the sign operation makes it difficult to understand the algorithm performance. Inspired by BLO, we design and analyze a new set of robust training algorithms termed Fast Bi-level AT (Fast-BAT), which effectively defends sign-based projected gradient descent (PGD) attacks without using any gradient sign method or explicit robust regularization. In practice, we show our method yields substantial robustness improvements over baselines across multiple models and datasets. Codes are available at https://github.com/OPTML-Group/Fast-BAT.