Towards Understanding Fast Adversarial Training

1 INTRODUCTION . Adversarial examples are carefully crafted versions of the original data that successfully mislead a classifier ( Szegedy et al. , 2013 ) , while realizing minimal change in appearance when viewed by most humans . Although deep neural networks have achieved impressive success on a variety of challenging machine learning tasks , the existence of such adversarial examples has hindered the application of deep neural networks and drawn great attention in the deep-learning community . Empirically , the most successful defense thus far is based on Projected Gradient Descent ( PGD ) adversarial training ( Goodfellow et al. , 2014 ; Madry et al. , 2017 ) , augmenting the data of interest with strong adversarial examples , to help improve model robustness . Although effective , this approach is not efficient and may take multiple days to train a moderately large model . On the other hand , one of the early versions of adversarial training , based on a weaker Fast Gradient Signed Method ( FGSM ) attack , is much more efficient but suffers from “ catastrophic overfitting , ” a phenomenon where the robust accuracy with respect to strong attacks suddenly drops to almost zero during training ( Tramèr et al. , 2017 ; Wong et al. , 2019 ) , and fails to provide robustness against strong attacks . Fast adversarial training ( Wong et al. , 2019 ) is a simple modification to FGSM , that mitigates this issue . By initializing FGSM attacks with large randomized perturbations , it can efficiently obtain robust models against strong attacks . Although the modification is simple , the underlying reason for its success remains unclear . Moreover , fast adversarial training is only compatible with a cyclic learning rate schedule ( Smith & Topin , 2019 ) , with a limited number of training epochs , resulting in sub-optimal robust accuracy compared to PGD adversarial training ( Rice et al. , 2020 ) . When fast adversarial training runs for a large number of epochs , it still suffers from catastrophic overfitting , similar to vanilla FGSM adversarial training . Therefore , it remains an unfinished task to obtain the effectiveness of PGD adversarial training and the efficiency of FGSM adversarial training simultaneously . In this paper , we conduct experiments to show that the key to the success of fast adversarial training is not avoiding catastrophic overfitting , but being able to retain the robustness of the model when catastrophic overfitting occurs . We then utilize this understanding to propose a simple fix to fast adversarial training , making possible the training of it for a large number of epochs , without sacrificing efficiency . We demonstrate that , as a result , we yield improved performance . We also revisit a previously developed technique , FGSM adversarial training as a warmup ( Wang et al. , 2019 ) , and combine it with our training strategy to further improve performance with small additional computational overhead . The resulting method outperforms the state-of-the-art approach , PGD adversarial training ( Rice et al. , 2020 ) , while consuming much less training time . Our contributions are summarized as follows : • We conduct experiments to explain both the success and the failure of fast adversarial training for various cases . • We propose an alternative training strategy as a fix to fast adversarial training , which is equivalently efficient but allows training for a large number of epochs , and hence achieves better performance . • We propose to utilize the improved fast adversarial training as a warmup for PGD adversarial training , to outperform the state-of-the-art adversarial robustness , with reduced computation . 2 BACKGROUND AND RELATED WORK . The existence of adversarial examples in deep learning was initially reported in ( Szegedy et al. , 2013 ) . Since then , many approaches have been proposed to mitigate this issue and improve the adversarial robustness of models . A straightforward method is data augmentation , where adversarial examples are generated before the back-propagation at each iteration and used for model updates . This approach is referred to as adversarial training . It was first used with a gradient-based single-step adversarial attack , also known as the Fast Gradient Sign Method ( FGSM ) ( Goodfellow et al. , 2014 ) . Later , ( Kurakin et al. , 2016 ) found that models trained with FGSM tend to overfit and remain vulnerable to stronger attacks . They proposed a multi-step version of FGSM , namely the Basic Iterative Method ( BIM ) , seeking to address its weaknesses . Randomized initialization for FGSM then was introduced in ( Tramèr et al. , 2017 ) , leading to R+FGSM to increase the diversity of attacks and mitigate the overfitting issue . Finally , ( Madry et al. , 2017 ) combined randomized initialization with multi-step attacks to propose projected gradient descent ( PGD ) attacks , and showed its corresponding adversarial training is able to provide strong adversarial robustness ( Athalye et al. , 2018 ) . As PGD adversarial training is effective , many works have tried to improve upon it ( Zhang et al. , 2019b ; Xie et al. , 2019 ) . However , a recent study ( Rice et al. , 2020 ) conducted extensive experiments on adversarially trained models and demonstrated that the performance gain from almost all recently proposed algorithmic modifications to PGD adversarial training is no better than a simple piecewise learning rate schedule and early stopping to prevent overfitting . In addition to adversarial training , a great number of adversarial defenses have been proposed , yet most remain vulnerable to stronger attacks ( Goodfellow et al. , 2014 ; Moosavi-Dezfooli et al. , 2016 ; Papernot et al. , 2016 ; Kurakin et al. , 2016 ; Carlini & Wagner , 2017 ; Brendel et al. , 2017 ; Athalye et al. , 2018 ) . A major drawback of many defensive models is that they are heuristic and vulnerable to adaptive attacks that are specifically designed for breaking them ( Carlini et al. , 2019 ; Tramer et al. , 2020 ) . To address this concern , many works have focused on providing provable/certified robustness of deep neural networks ( Hein & Andriushchenko , 2017 ; Raghunathan et al. , 2018 ; Kolter & Wong , 2017 ; Weng et al. , 2018 ; Zhang et al. , 2018 ; Dvijotham et al. , 2018 ; Wong et al. , 2018 ; Wang et al. , 2018 ; Lecuyer et al. , 2018 ; Li et al. , 2019 ; Cohen et al. , 2019 ) , yet their certifiable robustness can not match the empirical robustness obtained by adversarial training . Among all adversarial defenses that claim empirical adversarial robustness , PGD adversarial training has stood the test of time . The only major caveat to PGD adversarial training is its computational cost , due to the iterative attacks at each training step . Many recent works try to reduce the computational overhead of PGD adversarial training . ( Shafahi et al. , 2019 ) proposes to update adversarial perturbations and model parameters simultaneously . By performing multiple updates on the same batch , it is possible to imitate PGD adversarial training with accelerated training speed . Redundant calculations are removed in ( Zhang et al. , 2019a ) during back-propagation for constructing adversarial examples , to reduce computational overhead . Recently , ( Wong et al. , 2019 ) shows surprising results that FGSM adversarial training can obtain strongly robust models if a large randomized initialization is used for FGSM attacks . However , they are forced to use a cyclic learning rate schedule ( Micikevicius et al. , 2017 ) and a small number of epochs for the training . This issue limits its performance , especially when compared to state-of-the-art PGD adversarial training with early stopping ( Rice et al. , 2020 ) . 3 FAST ADVERSARIAL TRAINING . 3.1 PRELIMINARIES . We consider the task of classification over samples ( x , y ) ∈ ( X , Y ) . Consider a classifier fθ : X → Y parameterized by θ , and a loss function L. For a natural example x ∈ X , an adversarial example x′ satisfies D ( x , x′ ) < for a small > 0 , and fθ ( x ) 6= fθ ( x′ ) , where D ( · , · ) is some distance metric , i.e. , x′ is close to x but yields a different classification result . The distance is often described in terms of an ` p metric , and we focus on the ` ∞ metric in this paper . Adversarial training is an approach for training a robust model against adversarial attacks . It represents the objective of obtaining adversarial robustness in terms of a robust optimization problem , defined as min θ E ( x , y ) ∼X max ‖x′−x‖∞ < ( L ( fθ ( x′ ) , y ) ) ( 1 ) It approximates the inner maximization by constructing adversarial examples based on natural examples , and then the model parameters θ are updated via an optimization method with respect to the adversarial examples , instead of the natural ones . One of the simplest choices of attack for adversarial training is the Fast Gradient Sign Method ( FGSM ) ( Goodfellow et al. , 2014 ) : x′ = x+ sign ( ∇xL ( fθ ( x ) , y ) ) ( 2 ) Before the introduction of fast adversarial training ( Wong et al. , 2019 ) , which we will introduce later , it was commonly believed that FGSM adversarial training fails to provide strong robustness ( Kurakin et al. , 2016 ) . During FGSM adversarial training , the robust accuracy of the model would suddenly drop to almost 0 % after a certain point , when evaluated against PGD attacks . This phenomenon was referred to as “ catastrophic overfitting ” in ( Wong et al. , 2019 ) . The cause of catastrophic overfitting was studied extensively in ( Tramèr et al. , 2017 ) : during training , since FGSM is a simple attack , the model learns to fool the FGSM attacks by inducing gradient masking/obfuscated gradient ( Athalye et al. , 2018 ) ; that is , the gradient is no longer a useful direction for constructing adversarial examples . The existence of catastrophic overfitting has prohibited the use of FGSM adversarial training . To mitigate this issue , ( Madry et al. , 2017 ) introduced a multi-step variant of FGSM , namely Projected Gradient Descent ( PGD ) , which takes multiple small steps with stepsize α to construct adversarial examples instead of one large step as in FGSM : x′t+1 = Π‖x′−x‖∞≤ ( x′t + αsign ( ∇x′tL ( fθ ( x ′ t ) , y ) ) ) ( 3 ) Extensive experimental results ( Madry et al. , 2017 ; Athalye et al. , 2018 ) have shown that , unless the model is particularly designed for creating obfuscated gradients ( Tramer et al. , 2020 ) , PGD attacks are generally exempt from overfitting . Consequently , adversarial training with PGD leads to robust models against strong attacks , although its computational cost is often an order of magnitude more expensive than standard training and FGSM adversarial training . Recently , in contrast to conventional believe , ( Wong et al. , 2019 ) proposed fast adversarial training and suggested it is possible to construct strongly robust models via FGSM adversarial training . They showed it is important to initialize a FGSM attack with large randomized perturbations , to protect FGSM adversarial training from overfitting . Although randomly initialized FGSM ( R+FGSM ) has been used in previous works ( Tramèr et al. , 2017 ) , ( Wong et al. , 2019 ) points out that the scale of the randomized initialization was restrictive and needs to be enlarged . As a result , this simple modification enables R+FGSM adversarial training to obtain reasonable robustness against strong attacks .

Summary: The authors claimed in this paper that as the most empirically successful approach to defending adversarial examples, PGD-based adversarial training, is computationally inefficient. Fast adversarial training could mitigate this issue by training a model using FGSM attacks initialized with large randomized perturbations, but the underlying reason for its success remains unclear and it may still suffer from catastrophic overfitting. The authors conducted a series of experiments to figure out the key to the success and properties of fast adversarial training. The experimental results showed that fast adversarial training cannot avoid catastrophic overfitting, but could be able to recover from catastrophic overfitting quickly. Based on all of the observations, the authors proposed a simple method to improve fast adversarial training by using PGD attack as training instead of R+FGSM attack (proposed in fast adversarial training) when overfitting happens, or using fast adversarial training as a warmup. The proposed methods could achieve slightly better performance than the current state-of-art approach while reducing the training time significantly.