Adversarial Distributional Training for Robust
Deep Learning

Dept. of Comp. Sci. & Tech., Institute for AI, BNRist Center Tsinghua-Bosch Joint MLCenter, THBI Lab, Tsinghua University, Beijing, 100084 China{dyp17, dzj17, pty17}@mails.tsinghua.edu.cn, {suhangss, dcszj}@mail.tsinghua.edu.cn

Parameterizing Adversarial Distributions

Adversarial training (AT) is among the most effective techniques toimprove model robustness, which can be formulated as."178

where 𝑓$ is the DNN, 𝐿 is a loss function (e.g., cross-entropy loss), and 𝑆 ={𝛿: 𝛿 = ≤ 𝜖} is a perturbation set.
The inner problem can be solved by projected gradient descent (Madry etal., 2018) as𝛿1AB8 = Π- 𝛿1A + 𝛼 ⋅ sign 𝛻I 𝐿 𝑓$ 𝑥1 + 𝛿1A , 𝑦1.

Adversarial Distributional Training (ADT)ADT models the adversarial perturbations around each natural example 𝑥1
by a distribution 𝑝(𝛿1 ) as
6

1min ' max 𝔼_(*+) 𝐿 𝑓$ 𝑥1 + 𝛿1 , 𝑦1
$ 𝑛_(*+ )∈`.

178

The inner maximization aims to learn an adversarial distribution, such that apoint drawn from it is likely an adversarial example.
The outer minimization aims to adversarially train the model parameters byminimizing the expected loss over the worst-case adversarial distributions.

Settings: CIFAR-10 with Wide-ResNet-28-10, 𝜖 = 8/255."

61min ' max 𝐿 𝑓$ 𝑥1 + 𝛿1 , 𝑦1 ,$ 𝑛*+ ∈-Experiments

tanh,∗ +/∗$~3(0, 6)$<" : !"."

tanh,∗ +/∗#"!"White-box robustness$~3(0, 6)#"$tanh,∗ 0101

z~9(−1,1)

8

x"x"

(a)

(b)

(c)

ADTEXPADTEXP-AM

ADTIMP-AM

ADTEXP: modeling adversarial perturbations around an input data using adistribution with an explicit density function:
𝛿1 = 𝜖 ⋅ tanh(𝑢1 ), 𝑢1 = 𝑁

𝜇1 , diag 𝜎1T

To estimate the gradient of 𝐽(𝑝W+ 𝛿1 , 𝜃) with respect to 𝜙1 , we adopt theBlack-box robustness
PGD-20, ! = 8/255

Source Model

Introduction

Yinpeng Dong*, Zhijie Deng*, Tianyu Pang, Hang Su, Jun Zhu

MIM, ! = 8/255

90Standard

0.00

85.35

85.28

86.24

86.23

ATPGD

73.34

50.03

65.71

66.47

67.22

ADTEXP

66.92

63.84

52.18

64.26

65.03

ADTEXP-AM

66.85

65.63

65.06

51.95

64.91

ADTIMP-AM

68.82

67.69

66.87

66.42

52.286030900.00

85.24

85.02

85.98

85.95

73.45

51.40

65.79

66.80

67.30

67.86

63.99

53.27

64.52

65.51

65.74

65.24

64.58

52.99

65.02

65.36

66.37

65.35

65.10

52.64

60

30

00

reparameterization trick as
Target Model

Loss landscape visualization
ADTEXP-AM: amortizing the inner optimization of ADTEXP by using a
conditional generator network. We learn a generator 𝑔W that takes a natural

Note thatmax 𝔼_(*+) 𝐿 𝑓$ 𝑥1 + 𝛿1 , 𝑦1_(*+ )∈`≤ max 𝐿 𝑓$ 𝑥1 + 𝛿1 , 𝑦1*+ ∈-indicating that ADT will degenerate into AT.
Therefore, we add an entropic regularization term into the objective as
61
min ' max 𝐽(𝑝 𝛿1 , 𝜃)
$ 𝑛_(*+ )∈`178

𝐽 𝑝 𝛿1 , 𝜃 = 𝔼_(*+) 𝐿 𝑓$ 𝑥1 + 𝛿1 , 𝑦1+ 𝜆𝐻 𝑝 𝛿1 .

Advantages:• ADT can characterize diverse adversarial examples, many of which may
be generated by different attacks, such that ADT leads to better
generalizability across attacks.
• The adversarial distributions in ADT can better explore the space ofpossible adversarial examples, leading to better robustness
performance.

example 𝑥1 as input, and outputs the parameters {𝜇1 , 𝜎1 } of the adversarial
distribution.
(a) Standard(b) ATPGDADTIMP-AM: using implicit distributions to characterize the adversarial
perturbations. We implicitly define a conditional adversarial distribution as𝛿1 = 𝑔W 𝑧, 𝑥1 ,𝑧~𝑈 −1,1 .
Since the entropy of the implicit distributions cannot be estimated exactly,
We instead maximize the variational lower bound of the entropy.

Diversity of Adversarial Examples(c) ADTEXP
Dominant eigenvalue
ModelStandard
1.8301±6.3663
ATPGD
0.0242±0.0478
ADTEXP
0.0180±0.0311
ADTEXP-AM 0.0181±0.0270
ADTIMP-AM
0.0211±0.0353(d) ADTEXP-AM(e) ADTIMP-AM(f) Comparison on the HessianConclusion• We proposed adversarial distribution training (ADT) framework forlearning robust models.
• We introduced three ways to parameterize the adversarial distributions• We performed extensive experiments to validate the effectiveness of ourproposed methods.
• Our code is available at: