Year: 2021

Abstract:
Instances-reweighted adversarial training (IRAT) can significantly boost the robustness of trained models, where data being less/more vulnerable to the given attack are assigned smaller/larger weights during training. However, when tested on attacks different from the given attack simulated in training, the robustness may drop significantly (e.g., even worse than no reweighting). In this paper, we study this problem and propose our solution—locally reweighted adversarial training (LRAT). The rationale behind IRAT is that we do not need to pay much attention to an instance that is already safe under the attack. We argue that the safeness should be attack-dependent, so that for the same instance, its weight can change given different attacks based on the same model. Thus, if the attack simulated in training is mis-specified, the weights of IRAT are misleading. To this end, LRAT pairs each instance with its adversarial variants and performs local reweighting inside each pair, while performing no global reweighting—the rationale is to fit the instance itself if it is immune to the attack, but not to skip the pair, in order to passively defend different attacks in future. Experiments show that LRAT works better than both IRAT (i.e., global reweighting) and the standard AT (i.e., no reweighting) when trained with an attack and tested on different attacks.

heading: 1 INTRODUCTION
text: A growing body of research shows that neural networks are vulnerable to adversarial examples, i.e., test inputs that are modified slightly yet strategically to cause misclassification (Carlini & Wagner, 2017a; Finlayson et al., 2019; Kurakin et al., 2017; Nguyen et al., 2015; Szegedy et al., 2014; Wang et al., 2019; Zhang et al., 2020b). It is crucial to train a robust neural network to defend against such examples for security-critical computer vision systems, such as autonomous driving and medical diagnostics (Chen et al., 2015; Ma et al., 2021; Miyato et al., 2017; Nguyen et al., 2015; Szegedy et al., 2014). To mitigate this issue, adversarial training methods have been proposed in recent years (Balunovic & Vechev, 2019; Goodfellow et al., 2015; Madry et al., 2018; Shafahi et al., 2020; Wang et al., 2020a; Wu et al., 2020). By injecting adversarial examples into training data, adversarial training methods seek to train an adversarial-robust deep network whose predictions are locally invariant in a small neighborhood of its inputs (Bai et al., 2019; He et al., 2018; Papernot et al., 2016; Raghunathan et al., 2020; Tsipras et al., 2019; Yang et al., 2020).
Due to the diversity and complexity of adversarial data, over-parameterized deep networks have insufficient model capacity in adversarial training (AT) (Zhang et al., 2021). To obtain a robust model given fixed model capacity, Zhang et al. (2021) suggest that we do not need to pay much attention to an instance that is already safe under the attack, and propose instance-reweighted adversarial training (IRAT), which performs global reweighting with a given attack. To identify safe/non-robustness instances, they propose a geometric distance (GD) between natural data points and current class boundary. Instances being closer to/farther from the class boundary is more/less vulnerable to the given attack, and should be assigned larger/smaller weights during AT. This geometry-aware IRAT (GAIRAT) significantly boosts the robustness of the trained models when facing the given attack.
However, when tested on attacks that are different from the given attack simulated in IRAT, the robustness of IRAT drops significantly (e.g., even worse than no reweighting). First, we find that a large number of instances are actually overlooked during IRAT. Figure 1(a) shows that, for approximately four-fifths of the instances, their corresponding adversarial variants are assigned very low weights (less than 0.2). Second, we find that the robustness of the IRAT-trained classifier drops significantly when facing an unseen attack. Figures 1(b) and 1(c) show that the classifier trained by
GAIRAT (with projected gradient descent (PGD) attack (Madry et al., 2018)) has lower robustness when attacked by the unseen Carlini and Wagner attack (CW) (Carlini & Wagner, 2017b) compared with the robustness of standard adversarial training (SAT) (Madry et al., 2018).
Since the robustness of a model is not determined by any single attack, the improved performance for a kind of given attack is not sufficient to justify robustness. As shown in Figure 2, the ranking of attack intensity varies with different datasets, adversarial training methods and so on, which means there is not the strongest attack in all situations. For another, previous studies of the adversarial detection (Lee et al., 2018; Ma et al., 2018; Gao et al., 2021) show that the stronger adversarial examples for robust classifiers to predict, the easier for the adversarial detectors to detect. This means improving performance not only on stronger attacks, but also on weaker ones, as some of attackers may choose to use weaker attacks to escape from the adversarial detection. Hence, robustness needs the network to consider a variety of potential attacks.
In this paper, we investigate the reasons behind the failure of IRAT on unseen attacks. Unlike the common scenario of the classification problem where the training and testing data are fixed, there are different adversarial variants for the same instance in AT, e.g., PGD-based or CW-based adversarial variants. A natural question comes with this—whether there are inconsistent vulnerabilities in the view of different attacks? The answer is affirmative. Figure 3 visualizes this phenomenon using t-SNE (Van der Maaten & Hinton, 2008). The four subfigures in Figure 3 visualize inconsistent vulnerable instances in different views using t-SNE. The red dots in all subfigures represent consistently vulnerable instances between different views, while the blue dots represent the inconsistent vulnerable instances. From the SAT-trained classifier (Figure 3(a)-3(d)), we can clearly see that a large number of vulnerable instances are inconsistent (the blue dots dominate in all the subfigures).
Given the above investigation, we argue that the safeness of instances is attack-dependent, that is, for the same instance, its weight can change given different attacks based on the same model. Thus, if the attack simulated in training is mis-specified, the weights of IRAT are misleading. In order to ameliorate this pessimism of IRAT, we propose our solution—locally reweighted adversarial training (LRAT). As shown in Figure 4, LRAT pairs each instance with its adversarial variants and performs local reweighting
inside each pair, while performing no global reweighting. The rationale of LRAT is to fit the instance itself if it is immune to the attack, and in order to passively defend different attacks in future, LRAT does not skip the pair.
In terms of the common attribute of adversarial attacks that misleading the classifier with a low probability of predicting the correct label and a high probability of predicting the false label (Madry et al., 2018; Carlini & Wagner, 2017b), we propose a general reweighting strategy that is applicable to various representatively attacks. Our experimental results show that compared with AT, LRAT can achieve better results on various simulated attacks. Other than previous global reweighting training that GAIRAT, LRAT can boost the performance of AT on PGD with no decline on other attacks.

heading: 2 ADVERSARIAL TRAINING
text: In this section, we briefly review existing adversarial training methods (Madry et al., 2018; Zhang et al., 2021). Let (X , d∞) be the input feature space X with a metric d∞(x,x′) = ‖x− x′‖∞, and B [x] = {x′ | d∞(x,x′) ≤ } be the closed ball of radius > 0 centered at x in X . The dataset S = {xi, yi}ni=1, where xi ∈ X , yi ∈ Y = {0, 1, . . . ,K−1}. We use fθ(x) to denote a deep neural network parameterized by θ. Specifically, fθ(x) predicts the label of an input instance x via:
fθ(x) = arg max k∈K pk(x; θ), (1)
where pk(x; θ) denotes the predicted probability (softmax on logits) of x belonging to class k.

heading: 2.1 STANDARD ADVERSARIAL TRAINING
text: The objective function of SAT (Madry et al., 2018) is
min fθ∈F
1
n n∑ i=1 `(fθ(x̃i), yi), (2)
where x̃i = arg maxx̃i∈B [x] `(fθ(x̃i), yi) and F = {f : X → Y}. The selected x̃ is the most adversarial variant within the -ball center at x. The loss function ` : RK × Y → R is a composition of a base loss `B : 4K−1 × Y → R (e.g., the cross-entropy loss) and an inverse link function `L : RK → 4K−1 (e.g., the soft-max activation), where 4K−1 is the corresponding probalility simplex. Namely, `(fθ(·), y) = `B(`L(fθ(·)), y). PGD (Madry et al., 2018) is the most common approximation method for searching the most adversarial variant. Starting from x(0) ∈ X , PGD (with step size α > 0) works as follows:
x(t+1) = ΠB [x(0)](x (t) + α sign(∇xt`(fθ(x(t), y))), t ∈ N, (3)
where N is the number of iterations; x(0) refers to the starting point that natural instance (or a natural instance perturbed by a small Gaussian or uniformly random noise); y is the corresponding label for x(0); x(t) is the adversarial variant at step t; ΠB [x(0)](·) is the projection function that projects the adversarial variant back into the -ball centered at x(0) if necessary.

heading: 2.2 GEOMETRY-AWARE INSTANCE-REWEIGHTED ADVERSARIAL TRAINING
text: GAIRAT is a typical IRAT proposed by Zhang et al. (2021). GAIRAT argues that natural training data farther from/close to the decision boundary are safe/non-robustness, and should be assigned with smaller/larger weights. Let ω(x, y) be the geometry-aware weight assignment function on the loss of the adversarial variant x̃, where the generation of x̃ follows SAT. GAIRAT aims to
min fθ∈F
1
n n∑ i=1 ω(xi, yi)`(fθ(x̃i), yi). (4)
Eq. (4) rescales the loss using a function ω(x, y). This function is non-increasing w.r.t. GD, which is defined as the least steps that the PGD method needs to successfully attack the natural instances. The method then normalizes ω to ensure that ω(x, y) ≤ 0 and 1n ∑n i=1 ω(xi, yi) = 1. Finally GAIRAT employs a bootstrap period in the initial part of the training by setting ω(xi, yi) = 1, thereby performing regular training and ignoring the geometric-distance of input (xi, yi).

heading: 3 THE LIMITATION OF IRAT: INCONSISTENT VULNERABILITY IN DIFFERENT VIEWS
text: The difference between Eq. (2) and Eq. (4) is the addition of the geometry-aware weight ω(x, y). According to GAIRAT (Zhang et al., 2021), more vulnerable instances should be assigned larger weights. However, the relative vulnerability between instances may vary in different situations, such as for different adversarial variants. V represents the selected variable to measure the vulnerability between the classifier and adversarial variants, and the smaller V , the more vulnerable is the instance. For the PGD-based adversarial variant, the lower predicted probability it has on true class, the smaller V . Here, we give the definition of VPGD. Definition 1 (Vulnerability in the view of PGD). In the view of PGD, the vulnerability VPGD regarding x̃ (generated by PGD) is defined as
VPGD(x̃,y) := py(x̃), (5)
where py denotes the predicted probability (softmax on logits) of x̃ belonging to the true class y.
For the CW-based adversarial variant, the relatively higher predicted probability it has on the false class, the larger VCW. Here, we give the definition of VCW.
Definition 2 (Vulnerability in the view of CW). In the view of CW, the vulnerability VCW regarding x̃ (generated by CW) is defined as
VCW(x̃,y) := zy(x̃)−max i6=y zi(x̃), (6)
where zy denotes the predicted logits of x̃ (CW) belonging to the true class y. The maxi6=y zi(x̃) denotes the maximum predicted logits of x̃ (CW) belonging to the false class i (i 6= y).
As shown in Figure 5, the dark yellow and dark blue are top-20% vulnerable instances in the view of PGD and CW, respectively. The frequency distribution of dark yellow in Figure 5(b) and dark blue in Figure 5(c) is clearly different, and the frequency distribution of dark blue in Figure 5(e) and dark yellow in Figure 5(f) is also different. This phenomenon means that the most vulnerable 10, 000 PGD adversarial variants and the most vulnerable 10, 000 CW adversarial variants are not from the same 10, 000 instances. As a consequence of this inconsistency, if the attack simulated in training is mis-specified, the weights of IRAT will be misleading.

heading: 4 LOCALLY REWEIGHTED ADVERSARIAL TRAINING
text: To break the limitation of IRAT and train a robust classifier against various attacks, we propose LRAT in this section, for which we perform local reweighting instead of global/no reweighting.

heading: 4.1 MOTIVATION OF LRAT
text: The Reweighting is Beneficial on the Given Attack. As suggested by GAIRAT (Zhang et al., 2021), the global reweighting indeed improves the robustness when tested on the given attack (PGD) simulated in training. Figures 1(b) and 1(c) also show that, as a global reweighting, GAIRAT improves the robustness against PGD (when PGD is simulated in training). Thus, when training and testing on the same attack, the rationale that we do not need to pay much attention to an already-safe instance under the attack is significant.
Local Reweighting Can Be Used to Take Care of Various Attacks. As introduced in Section 3, there is inconsistent vulnerability between instances in different views. Thus, to defend against various attacks, we should perform local reweighting inside each pair, while performing no global reweighting—the rationale is to fit the instance itself if it is immune to the attack, but not to skip the pair, in order to passively defend different attacks in future.

heading: 4.2 LEARNING OBJECTIVE OF LRAT
text: Let ω(x̃, y) be the weight assignment function on the loss of adversarial variant x̃. The inner optimization for generating x̃ depends on attacks, such as PGD (Eq. (2)). The outer minimization is:
min fθ∈F
1
n n∑ i=1 C − m∑ j=1 ω(x̃ij , yi)  + `(fθ(x̃ ∗ i ), yi) + m∑ j=1 ω(x̃ij , yi)`(fθ(x̃ij), yi)  , (7) where n is the number of instances in one mini-batch; m is the number of used attacks; C is a constant representing the minimum weight sum of each instance; the notation [a]+ stands for max{a, 0}. We impose two constraints on our objective Eq. (7): the first constraint ensures that ω(x̃, y) > 0 and the second constraint ensures that C > 0. The non-negative coefficient [C − ∑m j=1 ω(x̃ij , yi)]+ assigns some weight to the adversarial data term x̃∗, which serves as a gentle lower bound to avoid discarding instances during training. It can also be seen that different weights are assigned to different adversarial variants, respectively. LRAT pairs each instance with its adversarial variants and performs local reweighting inside each pair. Figure 4 provides an illustrative schematic of the learning objective of LRAT. We also consider a simple version of LRAT, i.e., locally simulated adversarial training (LSAT) that simulating attacks with no reweighting in training that ω(x̃, y) = 1, C < 1, m = 1 and x̃ is generated by any simulated attack, if x̃ is generated by PGD, LRAT recovers the SAT (Madry et al., 2018), which assigns equal weights to the losses of PGD adversarial variant.

heading: 4.3 REALIZATION OF LRAT
text: The realization of LRAT consists of the locally simulated and locally reweighted.
Locally Simulated. Previous adversarial training methods (Madry et al., 2018; Zhang et al., 2021) only simulated PGD attack in training. As analysed in Section 3, there are inconsistent vulnerablility in different views. Different adversarial attacks simulated in training can also behave differently. For defend against diverse attacks, we should consider simulating diverse attacks in training before reweighting. According to the difference objective function, we simulate two kind of representative attacks that CW attack and simplified targetted APGD-DLR attack (SAA).
The loss function in CW is: CW(f,x, y) := −zy(x̃) + max
i 6=y zi(x̃)− κc, (8)
where zy is the predicted logit of x̃ belonging to the true class y; κc = 50 is a hyper-parameter to denote the confidence (following (Cai et al., 2018; Zhang et al., 2020a)).
The loss function in targeted APGD-DLR is:
Targeted-DLR(f,x, y, t) = − zy(x ′)− zt(x′)
zπ1(x ′)− 12 · (zπ3(x′) + zπ4(x′))
, (9)
where π is the ordering of the components of z in decreasing order.
Locally Reweighted. The objective in Eq. (7) implies the optimization process of an adversarially robust network, with one step generating adversarial variants from natural counterparts and then reweighting loss on them, and one step minimizing the reweighted loss w.r.t. the model parameters θ. For each variant, the definition of the ω in Eq. (7) also means a lot. Zhang et al. (2021) heuristically design a non-increasing function ω:
ω(x, y) = (1 + tanh(λ+ 5× (1− 2× κ(x, y)/κmax)))
2 , (10)
where κ/κmax ∈ [0, 1], κmax ∈ N+, and λ ∈ R. κ(x, y) is the GD defined as the least steps that the PGD method needs to successfully attack the natural instance. κmax is the maximally allowed steps.
Algorithm 1 Locally Reweighted Adversarial Training (LRAT) Input: network architecture parametrized by θ, training dataset S, learning rate η, number of epochs T , batch size n, number of batches N , number of attacks m; Output: Adversarial robust network fθ; for epoch = 1, 2, . . . , T do
for mini-batch = 1,2,. . . ,N do Sample a mini-batch {(xi, yi)}ni=1 from S; for i = 1, 2, . . . , n do
for j = 1, 2, . . . ,m do Obtain adversarial data x̃ij of xi by the attack j; Calculate wij according to t(x̃ij ,yi) by Eq. (12);
end for end for θ ← θ − η ∑n i=1∇θ [[ C − ∑m j=1 wij ] + ` (fθ (x̃ ∗ i ) , yi) + ∑m j=1 wij` (fθ (x̃ij) , yi) ] /n;
end for end for
However, the efficacy of this heuristic reweighting function is limited. As mentioned in Figure 1 (c), when PGD is simulated in training, the robustness on CW attack decreases. For another, as shown in Figure 6, when CW is simulated in training, this reweighting function shows the same decrease when tested on CW.
Hence, a rational and effective reweighting function is necessary. The generations of adversarial variants follow different rules under different attacks, whereas their common attribute is to mislead the classifier with a low probability of predicting the correct label and a high probability of predicting the false label (Madry et al., 2018; Carlini & Wagner, 2017b). It is reasonable to consider the margin of predicted probability between the correct label and the false label as a variable that affects the reweighting function. Definition 3 (The variable factor). The variable factor t regarding adversarial variant x̃ is defined as
t(x̃,y) := py(x̃)−max i 6=y pi(x̃), (11)
where py denotes the softmax on logit of x̃ belonging to the true class y.
Given the variable factor t, we also need to consider how to define the reweighting function of t. As known, the reason why adversarial training improves adversarial robustness is that adversarial data with a low t are used instead of natural data with a high t. It implies the adversarial variant with an high t should be assigned a low weight. Motivated by this thinking, we propose a general reweighting function of t to obtain the weights of the corresponding variants, where the higher variable factor t, the lower weights ω. Definition 4 (The reweighting function). The reweighting function ω regarding the variable factor t is defined as
ω(t) := α(1− t)β , (12) where α > 0 and β > 0 are hyper-parameters of each attack.
We present our LRAT in Algorithm 1. LRAT uses different given attacks (e.g., PGD, Algorithm 2 in Appendix A) to obtain different adversarial variants, and leverages the attack-dependent reweighting strategy for obtaining their corresponding weights. For each mini-batch, LRAT reweights the loss of different adversarial variants according to our reweighting function, and then updates the model parameters by minimizing the sum of the reweighted loss on each instance.

heading: 5 EXPERIMENTS
text: In this section, we justify the efficacy of LRAT. We consider L∞-norm bounded perturbation that ||x̃− x||∞ ≤ in both training and evaluations in all experiments. All images of the CIFAR-10 are normalized into [0,1].

heading: 5.1 EXPERIMENTAL SETUP
text: We compare our proposed LSAT and LRAT with the no-reweighting strategy (i.e., SAT (Madry et al., 2018)) and previous global-reweighting strategy (i.e., GAIRAT (Zhang et al., 2021)). Rice et al. (2020) show that, unlike standard training, overfitting in robust adversarial training decays test set performance during training. Thus, as suggested by Rice et al. (2020), we compare different methods on the performance of the best checkpoint model (the early stopping model at epoch 60). We employ ResNet (ResNet-18) (He et al., 2016) as the targeted classifier. Our experimental setup follows previous works (Madry et al., 2018; Wang et al., 2020b; Zhang et al., 2021). All networks are trained for 100 epochs using SGD with 0.9 momentum. The initial learning rate is 0.1, divided by 10 at epoch 60 and 90, respectively. The weight decay is 0.0002.
For generating the PGD adversarial data for updating the network, L∞-norm bounded perturbation train = 8/255; the maximum PGD step κmax = 10; step size α = train/10. For generating the CW adversarial data (Carlini & Wagner, 2017b), we follow the setup in (Cai et al., 2018; Zhang et al., 2020a), where the confidence κc = 50, and other hyper-parameters are the same as that of PGD above. For generating SAA adversarial data, we follow the adaptive step and DLR loss in (Croce & Hein, 2020), but only choose 3 targeted classes. Those attaining 3 highest scores at the original point x (excluding the correct one), and 20 steps for computational efficiency.
Robustness to adversarial data is the main evaluation indicator in adversarial training (Carlini et al., 2019; Chen et al., 2020; Cohen et al., 2019; Du et al., 2021; Pang et al., 2019; Yang et al., 2021; Zhu et al., 2021). Thus, we evaluate the robust models based on four evaluation metrics, i.e., standard test accuracy on natural data (Natural), robust test accuracy on adversarial data generated by projected gradient descent attack (PGD) (Madry et al., 2018), Carlini and Wagner attack (CW) (Carlini & Wagner, 2017b) and AutoAttack (AA) (Croce & Hein, 2020). In testing, L∞-norm bounded perturbation test = 8/255, the maximum PGD step K = 20, and step size α = /4. There is a random start in training and testing, i.e., uniformly random perturbations ([− train,+ train] and [− test,+ test]) added to natural instances. Note that, the extended version of GAIRAT that GAIRATRST uses additional 500K unlabeled data on CIFAR-10 dataset, and to make a fair comparison, adversarial training methods in our experiments only use original data and do not use additional data.

heading: 5.2 PERFORMANCE EVALUATION
text: In our experiments of LRAT, we simulate three representative attacks that PGD, CW and SAA. For adversarial variants CW and SAA, we use our reweighting function (Eq. (12)) to obtain their corresponding weights, where t follows Eq. (11). We choose the three hyper-parameters (C in Eq. (7), α, β in Eq. (12)) that α = 2, β = 0.5, and C = 0.1, and we analyze it in Appendix B. We evaluate the performance of LSAT first. As shown in Table 1, compared with SAT, by locally simulated on given attack CW and SAA, LSAT performs better when tested on the simulated attack. The results indicate that practitioners should choose to simulate the corresponding attack when there is only one type of attack need to defend against. For adaptive and unseen attacks, the adversarial defense could be described as a barrel effect: if there is a short slab, the barrel would leak. Similarly, if there is a weakness in defending against some attacks, the classifier would fail to predict. In this case, practitioners should choose to simulate the attack with higher intensity (e.g, AA in Table 2). For another, compared to AT, LRAT-SAA performs better on all attacks in testing (PGD, CW and AA), which also indicates that the simulated PGD attack in previous studies can be replaced with SAA to achieve better adversarial robustness.
Then we evaluate the performance of LRAT. As shown in Table 1, compared with LSAT, LRAT can boosts adversarial robustness on the simulated attack even further, which is an evidence that our reweighting function (Eq. (12)) works well. The results show that our locally reweighting strategy is superior to the no-reweighting strategy and can achieve better adversarial robustness on the simulated
attack. It means a lot for the defense on the attack with higher intensity, e,g., LRAT-SAA can perform best on AA. For defending against unseen attacks, we recommend that practitioners simulate multiple attacks and assign some weight to the SAA adversarial data term for each instance during training.
Compared with GAIRAT, LRAT has a great improvement under CW and AA but a decline on PGD. Although GAIRAT improves the performance under PGD and can be a good targeted defense against PGD, its poor performance on CW and AA makes GAIRAT not enough to be an effective adversarial defense in most scenarios . Meanwhile, the ablation study in Table 2 also shows involving geometric distance (GD) as a component leads to the decreased robustness when attacked by CW and AA. In contrast, LRAT reduces the threat of any potential attacks as an effective defense. Thus, the results also show that our local-reweighting strategy is superior to previous global-reweighting strategy. In general, the results affirmatively confirm the efficacy of LRAT.

heading: 6 CONCLUSION
text: It has been showing great potential to improve adversarial robustness by reweighting adversarial variants during AT. This paper provides a new perspective to this promising direction and aims to train a robust classifier to defend against various attacks. Our proposal, locally reweighted adversarial training (LRAT), pairs each instance with its adversarial variants and performs local reweighting inside each pair. LRAT will not skip any pairs during adversarial training such that it can passively defend against different attacks in future. Experiments show that LRAT works better than both IRAT (i.e., global reweighting) and the standard AT (i.e., no reweighting) when trained with an attack and tested on different attacks. As a general framework, LRAT provides insights on how to design powerful reweighted adversarial training under any potentially adversarial attacks.
ETHICS STATEMENT
This paper does not raise any ethics concerns. This study does not involve any human subjects, practices to data set releases, potentially harmful insights, methodologies and applications, potential conflicts of interest and sponsorship, discrimination/bias/fairness concerns, privacy and security issues, legal compliance, and research integrity issues.
REPRODUCIBILITY STATEMENT
To ensure the reproducibility of experimental results, we will provide a link for an anonymous repository about the source codes of this paper in the discussion phase.

heading: A ADVERSARIAL ATTACK
text: Algorithm 2 and Algorithm 3 are the adversarial data generation of PGD and CW, respectively. The loss function in PGD is:
`CE := − log py(x̃), (13)
where py denotes the predicted probability (softmax on logits) of x̃ belonging to the true class y.
The loss function in CW is:
`CW := −zy(x̃) + max i 6=y zi(x̃)− κc, (14)
where zy denotes the logits of x̃ belonging to the true class y; κ = 50 (following the setup in (Cai et al., 2018; Zhang et al., 2020a)) is a hyper-parameter to denote the confidence.

heading: B EXPERIMENTAL DETAILS
text: Weighting Normalization. In our experiments, we impose another constraint on our objective Eq. (7):
1
n n∑ i=1 [C − m∑ j=1 ω(x̃∗ij , yi)]+ + m∑ j=1 ω(x̃ij , yi)  = 1, (15) to implement a fair comparison with baselines.
Selection of Hyper-parameters. It is an open question how to define the decreasing function ω of t in Eq. (12). (or given the definition of ω in Eq. (12), how to select the hyper-parameters under different situations.) In our experiments, given an alternative value set {0.25, 0.5, 1.5, 2, 4}, we choose α, β in Eq. (12) that α = 2, β = 0.5, and given an alternative value set {0.1, 0.2, 0.4, 0.6}, we choose C in Eq. (7) that C = 0.1. Our experiments show that the performance has a minor variation between different hyper-parameters, and we choose the optimal hyper-parameters depending on whose robustness attacked by PGD is the best.
Adversarial Data Term. To avoid discarding instances during training, we impose the non-negative coefficient [C − ∑m j=1 ω(x̃ ∗ ij , yi)]+ in Eq. (7) to assign some weight to the adversarial data term. The definition of the adversarial data term can vary as required by different tasks. When practitioners only focus on the robustness under attacks simulated in training, this term can be eliminated. When practitioners focus on the robustness under attacks simulated in training and the accuracy on natural data, this term can be defined as the loss of the natural instance. When practitioners focus on the robustness under attacks both simulated and unseen in training, this term can be defined as the loss of the adversarial variant, and we recommend to use SAA adversarial variant.

heading: C EXPERIMENTAL RESOURCES
text: We implement all methods on Python 3.7 (Pytorch 1.7.1) with an NVIDIA GeForce RTX 3090 GPU with AMD Ryzen Threadripper 3960X 24 Core Processor. The CIFAR-10 dataset can be downloaded via Pytorch. Given the 50, 000 images from the CIFAR-10 training set, we conduct the adversarial training on ResNet-18 for classification. DNNS are trained using SGD with 0.9 momentum, the initial learning rate of 0.1 and the batch size of 128.

heading: D DISCUSSIONS ON THE DEFENSE AGAINST UNSEEN ATTACKS
text: As a general framework, LRAT provides insights on how to design powerful reweighting adversarial training under different adversarial attacks. Due to the inconsistent vulnerability in different views, reweighting adversarial training has the risk of weakening the ability to defend against unseen attacks. Thus, we recommend that practitioners simulate diverse attacks during training. Note that it does not
mean that practitioners should use different attacks indiscriminately—for instance, during standard adversarial training, mixing some weak adversarial data into PGD adversarial data will weaken the robustness on the contrary. The recommended diversity is diverse information focused on during adversarial data generation, such as SAA and CW.
Algorithm 2 Adversarial Data Generation in Projected Gradient Descent Attack (PGD) Input: natural data x ∈ X , label y ∈ Y , model f , loss funciton `CE , maximum PGD step K, perturbation bound , step size α; Output: adversarial data x̃; x̃← x; while K > 0 do x̃← ΠB [x](x̃+ αsign(∇x̃`CE(f(x̃), y)); K ← K − 1;
end while
Algorithm 3 Adversarial Data Generation in Carlini and Wagner Attack (CW) Input: natural data x ∈ X , label y ∈ Y , model f , loss funciton `CW , maximum PGD step K, perturbation bound , step size α; Output: adversarial data x̃; x̃← x; while K > 0 do x̃← ΠB [x](x̃+ αsign(∇x̃`CW (f(x̃), y)); K ← K − 1;
end while

Review summaries:
This paper presents a new method named LART that assigns weights to adversarial examples during adversarial training for better robustness. Compared to the previous baseline work, i.e., IART, the proposed method has overcame several disadvantages. Quantitative results demonstrate the effectiveness of the proposed method.

The paper studies the reweighting of adversarial training. It first points out the problem of GAIRAT: GAIRAT only improves the robust accuracy under PGD and lowers the accuracy of other attacks like AutoAttack. Based on the findings, the authors propose a new method: LRAT, which performs adversarial training using different attacks and gives different weights to the instances generated by different attacks.

Authors pointed out that instances-reweighted adversarial training (IRAT) suffer from vulnerability against the unseen types of attacks. Authors claimed that a large number of instances are actually overlooked in IRAT which may cause that phenomenon. Therefore, the authors suggest locally reweighted adversarial training (LRAT) which performs local reweighting between the adversarial variants pair.