Title: INSTANCE ADAPTIVE ADVERSARIAL TRAINING: IMPROVED ACCURACY TRADEOFFS IN NEURAL NETS

Abstract: Adversarial training is by far the most successful strategy for improving robustness of neural networks to adversarial attacks. Despite its success as a defense mechanism, adversarial training fails to generalize well to unperturbed test set. We hypothesize that this poor generalization is a consequence of adversarial training with uniform perturbation radius around every training sample. Samples close to decision boundary can be morphed into a different class under a small perturbation budget, and enforcing large margins around these samples produce poor decision boundaries that generalize poorly. Motivated by this hypothesis, we propose instance adaptive adversarial training -a technique that enforces samplespecific perturbation margins around every training sample. We show that using our approach, test accuracy on unperturbed samples improve with a marginal drop in robustness. Extensive experiments on CIFAR-10, CIFAR-100 and Imagenet datasets demonstrate the effectiveness of our proposed approach.

1. INTRODUCTION:

A key challenge when deploying neural networks in safety-critical applications is their poor stability to input perturbations. Extremely tiny perturbations to network inputs may be imperceptible to the human eye, and yet cause major changes to outputs. One of the most effective and widely used methods for hardening networks to small perturbations is "adversarial training" (Madry et al., 2018) , in which a network is trained using adversarially perturbed samples with a fixed perturbation size. By doing so, adversarial training typically tries to enforce that the output of a neural network remains nearly constant within an p ball of every training input.

Despite its ability to increase robustness, adversarial training suffers from poor accuracy on clean (natural) test inputs. The drop in clean accuracy can be as high as 10% on CIFAR-10, and 15% on Imagenet (Madry et al., 2018; Xie et al., 2019) , making robust models undesirable in some industrial settings. The consistently poor performance of robust models on clean data has lead to the line of thought that there may be a fundamental trade-off between robustness and accuracy (Zhang et al., 2019; Tsipras et al., 2019) , and recent theoretical results characterized this tradeoff (Fawzi et al., 2018; Shafahi et al., 2018; Mahloujifar et al., 2019) .

In this work, we aim to understand and optimize the tradeoff between robustness and clean accuracy. More concretely, our objective is to improve the clean accuracy of adversarial training for a chosen level of adversarial robustness. Our method is inspired by the observation that the constraints enforced by adversarial training are infeasible; for commonly used values of , it is not possible to achieve label consistency within an -ball of each input image because the balls around images of different classes overlap. This is illustrated on the left of Figure 1 , which shows that the -ball around a "bird" (from the CIFAR-10 training set) contains images of class "deer" (that do not appear in the training set). If adversarial training were successful at enforcing label stability in an = 8 ball around the "bird" training image, doing so would come at the unavoidable cost of misclassifying the nearby "deer" images that come along at test time. At the same time, when training images lie far from the decision boundary (eg., the deer image on the right in Fig 1 ), it is possible to enforce stability with large with no compromise in clean accuracy. When adversarial training on CIFAR-10, we see that = 8 is too large for some images, causing accuracy loss, while being unnecessarily small for others, leading to sub-optimal robustness. 

Bird Deer:



2. BACKGROUND:

Adversarial attacks are data items containing small perturbations that cause misclassification in neural network classifiers (Szegedy et al., 2014) . Popular methods for crafting attacks include the fast gradient sign method (FGSM) (Goodfellow et al., 2015) which is a one-step gradient attack, projected gradient descent (PGD) (Madry et al., 2018) which is a multi-step extension of FGSM, the C/W attack (Carlini & Wagner, 2017 ), DeepFool (Moosavi-Dezfooli et al., 2016) , and many more. All these methods use the gradient of the loss function with respect to inputs to construct additive perturbations with a norm-constraint. Alternative attack metrics include spatial transformer attacks (Xiao et al., 2018) , attacks based on Wasserstein distance in pixel space (Wong et al., 2019) , etc.

Defending against adversarial attacks is a crucial problem in machine learning. Many early defenses (Buckman et al., 2018; Samangouei et al., 2018; Dhillon et al., 2018) , were broken by strong attacks. Fortunately, adversarially training is one defense strategy that remains fairly resistant to most existing attacks.

Let D = {(x i , y i )} n i=1 denote the set of training samples in the input dataset. In this paper, we focus on classification problems, hence, y i ∈ {1, 2, . . . N c }, where N c denotes the number of classes. Let f θ (x) : R c×m×n → R Nc denote a neural network model parameterized by θ. Classifiers are often trained by minimizing the cross entropy loss given by

min θ 1 N (xi,yi)∼D -ỹi log(f θ (x i ))

where ỹi is the one-hot vector corresponding to the label y i . In adversarial training, instead of optimizing the neural network over the clean training set, we use the adversarially perturbed training set. Mathematically, this can be written as the following min-max problem

min θ max δi ∞≤ 1 N (xi,yi)∼D -ỹi log(f θ (x i ) + δ i ) (1)

This problem is solved by an alternating stochastic method that takes minimization steps for θ, followed by maximization steps that approximately solve the inner problem using k steps of PGD.

For more details, refer to Madry et al. (2018) .

Algorithm Sample a batch of training samples

{(x i , y i )} N batch i=1 ∼ D 3: if t < N warm then 4: i = w 5:

else 6:

Choose i using Alg 2 7:

end if 8:

x adv i = P GD(x i , y i , i )

9:

S + = {i|f (x i ) is correctly classified as y i } 10: S -= {i|f (x i ) is incorrectly classified as y i } 11: min θ 1 N batch i∈S+ L cls (x adv i , y i ) + i∈S-L cls (x i , y i ) 12: end for

3. INSTANCE ADAPTIVE ADVERSARIAL TRAINING:

To remedy the shortcomings of uniform perturbation radius in adversarial training (Section 1), we propose Instance Adaptive Adversarial Training (IAAT), which solves the following optimization:

EQUATION

Like vanilla adversarial training, we solve this by sampling mini-batches of images {x i }, crafting adversarial perturbations {δ i } of size at most { i }, and then updating the network model using the perturbed images.

The proposed algorithm is distinctive in that it uses a different i for each image x i . Ideally, we would choose each i to be as large as possible without finding images of a different class within the i -ball around x i . Since we have no a-priori knowledge of what this radius is, we use a simple heuristic to update i after each epoch. After crafting a perturbation for x i , we check if the perturbed image was a successful adversarial example. If PGD succeeded in finding an image with a different class label, then i is too big, so we replace i ← i -γ. If PGD failed, then we set i ← i + γ.

Since the network is randomly initialized at the start of training, random predictions are made, and this causes { i } to shrink rapidly. For this reason, we begin with a warmup period of a few (usually 10 epochs for CIFAR-10/100) epochs where adversarial training is performed using uniform for every sample. After the warmup period ends, we perform instance adaptive adversarial training.

A detailed training algorithm is provided in Alg. 1. 

= mem [j -1, i] + γ 2: Set 2 = mem [j -1, i] 3: Set 3 = mem [j -1, i] -γ 4: if f θ (P GD k (x i , y i , 1 )

) predicts as y i then 5:

Set i = 1 6: else if f θ (P GD k (x i , y i , 2 )) predicts as y i then 7:

Set i = 2 8: else 9: Set i = 3 10: end if 11: i ← (1 -β) mem [j -1, i] + β i 12: Update mem [j, i] ← i 13: Return i

4. EXPERIMENTS:

To evaluate the robustness and generalization of our models, we report the following metrics: (1) test accuracy of unperturbed (natural) test samples, (2) adversarial accuracy of white-box PGD attacks, (3) adversarial accuracy of transfer attacks and (4) accuracy of test samples under common image corruptions (Hendrycks & Dietterich, 2019) . Following the protocol introduced in Hendrycks & Dietterich (2019), we do not train our models on any image corruptions.

4.1. CIFAR:

On CIFAR-10 and CIFAR-100 datasets, we perform experiments on Resnet-18 and WideRenset-32-10 models following (Madry et al., 2018; Zhang et al., 2019) . All models are trained on PGD-10 attacks i.e., 10 steps of PGD iterations are used for crafting adversarial attacks during training. In the whitebox setting, models are evaluated on: (1) PGD-10 attacks with 5 random restarts, (2) PGD-100 attacks with 5 random restarts, and (3) PGD-1000 attacks with 2 random restarts. For Beating the robustness-accuracy tradeoff: In adversarial training, the perturbation radius is a hyper-parameter. Training models with varying produces a robustness-accuracy tradeoff curvemodels with small training achieve better natural accuracy and poor adversarial robustness, while models trained on large have improved robustness and poor natural accuracy. To generate this tradeoff, we perform adversarial training with in the range {1, 2, . . . 8}. Instance adaptive adversarial training is then compared with respect to this tradeoff curve in Fig. 3a , 3b. Two versions of IAAT are reported -with and without a warmup phase. In both versions, we clearly achieve an improvement over the accuracy-robustness tradeoff. Use of the warmup phase helps retain robustness with a drop in natural accuracy compared to its no-warmup counterpart.

Clean accuracy improves for a fixed level of robustness: On CIFAR-10, as shown in Table . 1, we observe that our instance adaptive adversarial training algorithm achieves similar adversarial robustness as the adversarial training baseline. However, the accuracy on clean test samples increases by 4.06% for Resnet-18 and 4.49% for WideResnet-32-10. We also observe that the adaptive training algorithm improves robustness to unseen image corruptions. This points to an improvement in overall generalization ability of the network. On CIFAR-100 (Table . 2), the performance gain in natural test accuracy further increases -8.79% for Resnet-18, and 9.22% for Wideresnet-32-10. The adversarial robustness drop is marginal.

Maintaining performance over a range of test : Next, we plot adversarial robustness over a sweep of values used to craft attacks at test time. Fig. 4a , 4b shows an adversarial training baseline with = 8 performs well at high regimes and poorly at low regimes. On the other hand, adversarial training with = 2 has a reverse effect, performing well at low and poorly at high regimes. Our instance adaptive training algorithm maintains good performance over all regimes, achieving slightly less performance than the = 2 model for small test , and dominating all models for larger test .

Interpretability of ::

We find that the values of i chosen by our adaptive algorithm correlate well with our own human concept of class ambiguity. Figure 2 (and Figure 6 in Appendix B) shows that a sampling of images that receive small i contains many ambiguous images, and these images are perturbed into a (visually) different class using = 16. In contrast, images that receive a large i have a visually definite class, and are not substantially altered by an = 16 perturbation. At test time, we evaluate the models on clean test samples and on whitebox adversarial attacks with = {4, 8, 12, 16}. PGD-1000 attacks are used. Additionally, we also report normalized mean corruption error (mCE), an evaluation metric introduced in Hendrycks & Dietterich (2019) to test the robustness of neural networks to image corruptions. This metric reports mean classification error of different image corruptions averaged over varying levels of degradation. Note that while accuracies are reported for natural and adversarial robustness, mCE reports classification errors, so lower numbers are better.

Our experimental results are reported in Table . 4. We observe a huge drop in natural accuracy for adversarial training (25%, 22% and 20% drop for Resnet-50, 101 and 152 respectively). Adaptive adversarial training significantly improves the natural accuracy -we obtain a consistent performance gain of 10+% on all three models over the adversarial training baseline. On whitebox attacks, IAAT outperforms the adversarial training baseline on low regimes, however a drop of 13% is observed at high 's ( = 16). On the corruption dataset, our model consistently outperforms adversarial training.

5. ABLATION EXPERIMENTS:



5.1. EFFECT OF WARMUP:

Recall from Section 3 that during warmup, adversarial training is performed with uniform normbound constraints. Once the warmup phase ends, we switch to instance adaptive training. From Table 5 and 6, we observe that when warmup is used, adversarial robustness improves with a small drop in natural accuracy, with more improvements observed in CIFAR-100. However, as shown in Fig. 3a and 3b, both these settings improve the accuracy-robustness tradeoff.

5.2. OTHER HEURISTICS:

We are interested in estimating instance-specific perturbation radius i such that predictions are consistent within the chosen i -ball. To obtain an exact estimate of such an i , we can perform a line search as follows: Given a discretization η and a maximum perturbation radius max , generate PGD attacks with radii {iη} max /η i=1 . Choose the desired i as the maximum iη for which the prediction remains consistent as that of the ground-truth label. We compare the performance of exact line search with that of IAAT in Table 7 . We observe that exact line search marginally improves compared to IAAT. However, exact line search is computationally expensive as it requires performing max /η additional PGD computations, whereas IAAT requires only 2.

6. CONCLUSION:

In this work, we focus on improving the robustness-accuracy tradeoff in adversarial training. We first show that realizable robustness is a sample-specific attribute: samples close to the decision boundary can only achieve robustness within a small ball, as they contain samples from a different class beyond this radius. On the other hand samples far from the decision boundary can be robust on a relatively large perturbation radius. Motivated by this observation, we develop instance adaptive adversarial training, in which label consistency constraints are imposed within sample-specific perturbation radii, which are in-turn estimated. Our proposed algorithm has empirically been shown to improve the robustness-accuracy tradeoff in CIFAR-10, CIFAR-100 and Imagenet datasets. (Lamb et al., 2019) , where adversarially trained models are optimized using mixup loss instead of the standard cross-entropy loss. In this paper, natural accuracy was shown to improve with no drop in adversarial robustness. However, the robustness experiments were not evaluated on strong attacks (experiments were reported only on PGD-20). We compare our implementation of mixup adversarial training with IAAT on stronger attacks in Table . 8. We observe that while natural accuracy improves for mixup, drop in adversarial accuracy is much higher than IAAT.

B SAMPLE VISUALIZATION:

A visualization of samples from CIFAR-10 dataset with the corresponding value assigned by IAAT is shown in Figure . 5. We observe that samples for which low 's are assigned are visually confusing (eg., top row of Figure . 5), while samples with high distinctively belong to one class.

In addition, we also show more visualizations of samples near decision boundary which contain samples from a different class within a fixed ∞ ball in Figure . 6. The infeasibility of label consistency constraints within the commonly used perturbation radius of ∞ = 8 is apparent in this visualization. Our algorithm effectively chooses an appropriate that retains label information within the chosen radius.

B.1 VISUALIZING PROGRESS:

Next, we visualize the evolution of over epochs in adaptive adversarial training. A plot showing the average growth, along with the progress of 3 randomly picked samples are shown in Fig. 7a and 7b. We observe that average converges to around 11, which is higher than the default setting of = 8 used in adversarial training. Also, each sample has a different profile -for some, increases well beyond the commonly use radius of = 8, while for others, it converges below it. In addition, a plot showing the histogram of 's at different snapshots of training is shown in Fig. 8 . We observe an increase in spread of the histogram as the training progresses.

C IMAGENET SWEEP OVER PGD ITERATIONS:

Testing against a strong adversary is crucial to assess the true robustness of a model. A popular practice in adversarial robustness community is to attack models using PGD with many attack iterations (Xie et al., 2019) . So, we test our instance adaptive adversarially trained models on a sweep of PGD iterations for a fixed level. Following (Xie et al., 2019) , we perform the sweep upto 2000 attack steps fixing = 16. The resulting plot is shown in Figure . 9. For all three Resnet models, we observe a saturation in adversarial robustness beyond 500 attack iterations. 

D SENSITIVITY ANALYSIS:

As shown in Alg. 2, IAAT algorithm has two hyper-parameters -smoothing constant β and discretization γ. In this section, we perform a sensitivity analysis of natural and robust accuracies by varying these hyper-parameters. Results are reported in Table. 9. We observe that the algorithm is not too sensistive to the choice of hyper-parameters. But the best performance is obtained for γ = 1.9 and β = 0.1.

E IMPLEMENTATION DETAILS E.1 CIFAR:

On CIFAR-10 and CIFAR-100 datasets, our implementation follows the standard adversarial training setting used in Madry et al. (2018) . During training, adversarial examples are generated using PGD-10 attacks, which are then used to update the model. All hyperparameters we used are tabulated in Table . 10.

:



Figures and Tables:

Figure 1: Overview of instance adaptive adversarial training. Samples close to the decision boundary (bird on the left) have nearby samples from a different class (deer) within a small L p ball, making the constraints imposed by PGD-8 / PGD-16 adversarial training infeasible. Samples far from the decision boundary (deer on the right) can withstand large perturbations well beyond = 8. Our adaptive adversarial training correctly assigns the perturbation radius (shown in dotted line) so that samples within each L p ball maintain the same class.

Figure 2: Visualizing training samples and their perturbations. The left panel shows samples that are assigned small (displayed below images) during adaptive training. These images are close to class boundaries, and change class when perturbed with ≥ 8. The right panel show images that are assigned large . These lie far from the decision boundary, and retain class information even with very large perturbations. All live in the range [0, 255]

Figure 3: Tradeoffs between accuracy and robustness: Each blue dot denotes an adversarially trained model with a different used at training (Training is marked next to blue dots). Models trained using instance adaptive adversarial training are shown in red. Adaptive training breaks through the Pareto frontier achieved by plain adversarial training with a fixed . For all models, adversarial accuracy is reported on PGD-1000 attacks with a fixed test = 8.

Figure 4: Plot of adversarial robustness over a sweep of test

Figure 5: Visualizing training samples with their corresponding perturbation. All live in the range [0, 255]

Figure 9: Imagenet robustness of IAAT over the number of PGD iterations

Robustness experiments on CIFAR-10. PGD attacks are generated with = 8. PGD 10 and PGD 100 attacks are generated with 5 random restarts, while PGD 1000 attacks are generated with 2 PGD 10 PGD 100 PGD 1000 acc. (PGD 1000 ) acc. (in %)

Table content: <table><tr><td>random restarts</td><td/><td/><td/><td/><td/><td/></tr><tr><td>Method</td><td>Natural</td><td colspan="3">Whitebox acc. (in %)</td><td colspan="2">Transfer (in %) Corruption</td></tr><tr><td/><td colspan="3">acc. (in %) Resnet-18</td><td/><td/><td/></tr><tr><td>Clean</td><td>94.21</td><td>0.02</td><td>0.00</td><td>0.00</td><td>3.03</td><td>72.71</td></tr><tr><td>Adversarial</td><td>83.20</td><td>43.79</td><td>42.30</td><td>42.36</td><td>59.80</td><td>73.73</td></tr><tr><td>IAAT</td><td>87.26</td><td>43.08</td><td>41.16</td><td>41.16</td><td>59.87</td><td>78.82</td></tr><tr><td/><td/><td/><td colspan="2">WideResnet 32-10</td><td/><td/></tr><tr><td>Clean</td><td>95.50</td><td>0.05</td><td>0.00</td><td>0.00</td><td>5.02</td><td>78.35</td></tr><tr><td>Adversarial</td><td>86.85</td><td>46.86</td><td>44.82</td><td>44.84</td><td>62.77</td><td>77.99</td></tr><tr><td>IAAT</td><td>91.34</td><td>48.53</td><td>46.50</td><td>46.54</td><td>58.20</td><td>83.13</td></tr></table>

Robustness experiments on CIFAR-100. PGD attacks are generated with = 8. PGD 10 and PGD 100 attacks are generated with 5 random restarts. PGD 1000 attacks are generated with 2

Table content: <table><tr><td>random restarts</td><td/><td/><td/><td/><td/></tr><tr><td>Method</td><td>Natural</td><td colspan="3">Whitebox acc. (in %)</td><td>Transfer acc. (in %)</td></tr><tr><td/><td colspan="4">acc. (in %) PGD 10 PGD 100 PGD 1000</td><td>PGD 1000</td></tr><tr><td/><td/><td/><td>Resnet-18</td><td/><td/></tr><tr><td>Clean</td><td>74.88</td><td>0.02</td><td>0.00</td><td>0.01</td><td>1.81</td></tr><tr><td>Adversarial</td><td>55.11</td><td>20.69</td><td>19.68</td><td>19.91</td><td>35.57</td></tr><tr><td>IAAT</td><td>63.90</td><td>18.50</td><td>17.10</td><td>17.11</td><td>35.74</td></tr><tr><td/><td/><td colspan="2">WideResnet 32-10</td><td/><td/></tr><tr><td>Clean</td><td>79.91</td><td>0.01</td><td>0.00</td><td>0.00</td><td>1.20</td></tr><tr><td>Adversarial</td><td>59.58</td><td>26.24</td><td>25.47</td><td>25.49</td><td>38.10</td></tr><tr><td>IAAT</td><td>68.80</td><td>26.17</td><td>24.22</td><td>24.36</td><td>35.18</td></tr></table>

Robustness results on other attacks for models trained using PGD-10 for WRN-32-10 model on CIFAR-10 dataset. Accuracies are reported in %

Table content: <table><tr><td>Algorithm</td><td colspan="6">Natural acc. PGD-1000 DeepFool MIFGSM CW40</td></tr><tr><td>Adversarial training</td><td>86.85</td><td>44.84</td><td/><td>65.28</td><td>54.66</td><td>55.62</td></tr><tr><td>IAAT</td><td>91.34</td><td>46.54</td><td/><td>66.58</td><td>53.99</td><td>56.80</td></tr><tr><td colspan="7">Table 4: Robustness experiments on Imagenet. All adversarial attacks are generated with PGD-1000.</td></tr><tr><td colspan="7">(↑) indicates higher numbers are better, while (↓) indicates lower numbers are better</td></tr><tr><td>Method</td><td>Natural</td><td colspan="4">Whitebox acc. (in %) (↑)</td><td>Corruption</td></tr><tr><td/><td>acc. (in %) (↑)</td><td>= 4</td><td>= 8</td><td>= 12</td><td>= 16</td><td>mCE (↓)</td></tr><tr><td/><td/><td>Resnet-50</td><td/><td/><td/><td/></tr><tr><td>Clean training</td><td>75.80</td><td>0.64</td><td>0.18</td><td>0.00</td><td>0.00</td><td>76.69</td></tr><tr><td>Adversarial training</td><td>50.99</td><td colspan="3">50.89 49.11 44.71</td><td>35.82</td><td>95.48</td></tr><tr><td>IAAT</td><td>62.71</td><td colspan="3">61.52 54.63 39.90</td><td>22.72</td><td>85.21</td></tr><tr><td/><td/><td colspan="2">Resnet-101</td><td/><td/><td/></tr><tr><td>Clean training</td><td>77.10</td><td>0.83</td><td>0.12</td><td>0.00</td><td>0.00</td><td>70.37</td></tr><tr><td>Adversarial training</td><td>55.42</td><td colspan="3">55.11 53.07 48.35</td><td>39.08</td><td>91.45</td></tr><tr><td>IAAT</td><td>65.29</td><td colspan="3">63.83 56.62 41.51</td><td>23.91</td><td>79.52</td></tr><tr><td/><td/><td colspan="2">Resnet-152</td><td/><td/><td/></tr><tr><td>Clean training</td><td>77.60</td><td>0.57</td><td>0.08</td><td>0.00</td><td>0.00</td><td>69.27</td></tr><tr><td>Adversarial training</td><td>57.26</td><td colspan="3">56.77 54.75 49.86</td><td>40.40</td><td>89.31</td></tr><tr><td>IAAT</td><td>67.44</td><td colspan="3">65.97 59.28 45.01</td><td>27.85</td><td>78.53</td></tr><tr><td>4.2 IMAGENET</td><td/><td/><td/><td/><td/><td/></tr></table>

Ablation: Effect of warmup on CIFAR-10

Table content: <table><tr><td>Method</td><td>Natural</td><td colspan="3">Whitebox acc. (in %)</td><td colspan="3">Transfer acc.(%) Corruption</td></tr><tr><td/><td colspan="4">acc. (%) PGD 10 PGD 100 PGD 1000</td><td colspan="2">PGD 1000</td><td>acc. (in %)</td></tr><tr><td/><td/><td/><td colspan="2">Resnet-18</td><td/><td/></tr><tr><td>IAAT (no warm)</td><td>89.62</td><td>40.55</td><td>38.15</td><td>38.08</td><td colspan="2">58.89</td><td>81.10</td></tr><tr><td>IAAT (warm)</td><td>87.26</td><td>43.08</td><td>41.16</td><td>41.16</td><td colspan="2">59.87</td><td>78.82</td></tr><tr><td/><td/><td/><td colspan="2">WideResnet 32-10</td><td/><td/></tr><tr><td>IAAT (no warm)</td><td>92.62</td><td>45.12</td><td>41.08</td><td>41.11</td><td colspan="2">53.08</td><td>84.92</td></tr><tr><td>IAAT (warm)</td><td>90.67</td><td>48.53</td><td>46.50</td><td>46.54</td><td colspan="2">58.20</td><td>83.13</td></tr><tr><td/><td colspan="5">Table 6: Ablation: Effect of warmup on CIFAR-100</td><td/></tr><tr><td>Method</td><td/><td>Natural</td><td colspan="3">Whitebox acc. (in %)</td><td colspan="2">Transfer acc.(%)</td></tr><tr><td/><td colspan="5">acc. (in %) PGD 10 PGD 100 PGD 1000</td><td/><td>PGD 1000</td></tr><tr><td/><td/><td/><td colspan="2">Resnet-18</td><td/><td/></tr><tr><td colspan="2">Adaptive (no warm)</td><td>68.34</td><td>14.76</td><td>13.29</td><td>13.30</td><td/><td>32.39</td></tr><tr><td colspan="2">Adaptive (warm)</td><td>63.90</td><td>18.50</td><td>17.10</td><td>17.11</td><td/><td>35.74</td></tr><tr><td/><td/><td/><td colspan="2">WideResnet 32-10</td><td/><td/></tr><tr><td colspan="2">Adaptive (no warm)</td><td>75.48</td><td>18.14</td><td>13.78</td><td>13.71</td><td/><td>24.00</td></tr><tr><td colspan="2">Adaptive (warm)</td><td>68.80</td><td>26.17</td><td>24.22</td><td>24.36</td><td/><td>35.18</td></tr></table>

Ablation: Comparison of IAAT with exact line search. Accuracies are reported in % for Resnet-18 model trained on CIFAR-10 dataset.

Table content: <table><tr><td>Algorithm</td><td colspan="3">Natural acc. PGD-10 PGD-1000</td></tr><tr><td>Full line search</td><td>88.67</td><td>43.26</td><td>41.37</td></tr><tr><td>IAAT</td><td>87.26</td><td>43.08</td><td>41.16</td></tr></table>

Comparison with Mixup

Table content: <table><tr><td>Method</td><td>Natural</td><td colspan="3">Whitebox acc. (in %)</td><td>Transfer attack (in %)</td></tr><tr><td/><td colspan="4">acc. (in %) PGD 10 PGD 100 PGD 1000</td><td>PGD 1000</td></tr><tr><td/><td/><td/><td>Resnet-18</td><td/><td/></tr><tr><td>Mixup</td><td>89.47</td><td>42.60</td><td>38.42</td><td>38.49</td><td>59.48</td></tr><tr><td>IAAT</td><td>87.26</td><td>43.08</td><td>41.16</td><td>41.16</td><td>59.87</td></tr><tr><td/><td/><td colspan="3">WideResnet 32-10</td><td/></tr><tr><td>Mixup</td><td>92.57</td><td>45.01</td><td>36.6</td><td>36.44</td><td>63.57</td></tr><tr><td>IAAT</td><td>90.67</td><td>48.53</td><td>46.50</td><td>46.54</td><td>58.20</td></tr><tr><td>A APPENDIX</td><td/><td/><td/><td/><td/></tr><tr><td colspan="3">A.1 COMPARISON WITH MIXUP</td><td/><td/><td/></tr><tr><td colspan="6">A recent paper that addresses the problem of improving natural accuracy in adversarial training is</td></tr><tr><td colspan="2">mixup adversarial training</td><td/><td/><td/><td/></tr></table>

Sensitivity of IAAT performance to hyperparameters β and γ. Models are trained on CIFAR-10 dataset using Wideresnet-32-10.

Table content: <table><tr><td colspan="2">0.00375 * 255 0.05</td><td>92.10</td><td>45.13</td></tr><tr><td colspan="2">0.00375 * 255 0.1</td><td>90.27</td><td>46.32</td></tr><tr><td colspan="2">0.00375 * 255 0.2</td><td>89.73</td><td>47.53</td></tr><tr><td colspan="2">0.0075 * 255 0.05</td><td>92.15</td><td>46.34</td></tr><tr><td>0.0075 * 255</td><td>0.1</td><td>91.34</td><td>48.53</td></tr><tr><td>0.0075 * 255</td><td>0.2</td><td>89.95</td><td>48.72</td></tr><tr><td>0.011 * 255</td><td>0.05</td><td>90.47</td><td>46.11</td></tr><tr><td>0.011 * 255</td><td>0.1</td><td>90.52</td><td>46.17</td></tr><tr><td>0.011 * 255</td><td>0.2</td><td>89.99</td><td>46.32</td></tr></table>

Peer review (iclr2020):
This paper addresses a limitation of adversarial training: in the most common formulation, the radius of L_p balls used to constrain the adversary during training is shared by all training points. Instead, this paper proposed to set multiple radii, where each point is given a radius appropriate given how far it lies from the decision boundary. The intuition behind this paper is correct and confirms recent findings: e.g., on excessive invariance in adversarially trained models. To set the radius for each example, a heuristic is introduced in Section 3. Because the heuristic is introduced without justification, it is difficult to assess the main contribution of this paper. Simple additions to the paper could help revise the submission. For instance, were other heuristics considered? If yes, why was this one chosen in particular? It may be problematic to set the value of the radius based on the approach that will be used to attack the model: perhaps other prototypicality metrics could be used for setting the value of this radius independently of any algorithms for finding adversarial examples? It would be interesting to use a different attack to set the radius during training and to attack the model at test time. In other words, given that the value of the per-example radius is set based on the model being trained, it is difficult to appreciate how much Algorithm 2 over or under estimates radii. The inadequacy of certain models in setting radii appears to be the motivation for the warm up step. Expanding Section 3 a bit to help the reader build their intuition for this aspect of the approach would help. Claims of robustness are made empirically. Unfortunately, results presented make it difficult to assess the validity of the approach. What is the value of epsilon chosen to attack the model in Figure 3? Does the adversary adapt and compute a per-example epsilon instead of a fixed epsilon? This should help attack examples whose radius during training was larger. Have you considered how the approach interacts with algorithms that achieve certifiable robustness? 1: repetition in “and enforcing large margins around these samples produce poor decision boundaries that generalize poorly” 1: The formulation of adversarial training was introduced in earlier papers from the 2000s, prior to Madry et al. 2: The result described in Figure 1 was presented in Jacobsen et al. [https://arxiv.org/abs/1903.10484] 2: The relationship to Ding et al. is not entirely clear, and would benefit from additional clarification. 4: Typo WideRenset