Bag of Tricks for Adversarial Training

1 INTRODUCTION . Adversarial training ( AT ) has been one of the most effective defense strategies against adversarial attacks ( Biggio et al. , 2013 ; Szegedy et al. , 2014 ; Goodfellow et al. , 2015 ) . Based on the primary AT frameworks like PGD-AT ( Madry et al. , 2018 ) , many improvements have been proposed from different perspectives , and demonstrate promising results ( detailed in Sec . 2 ) . However , the recent benchmarks ( Croce & Hein , 2020b ; Chen & Gu , 2020 ) find that simply early stopping the training procedure of PGD-AT ( Rice et al. , 2020 ) can attain the gains from almost all the previously proposed improvements , including the state-of-the-art TRADES ( Zhang et al. , 2019b ) . This fact is somewhat striking since TRADES also executes early stopping ( one epoch after decaying the learning rate ) in their code implementation . Besides , the reported robustness of PGD-AT in Rice et al . ( 2020 ) is much higher than in Madry et al . ( 2018 ) , even without early-stopping . This paradox motivates us to check the implementation details of these seminal works . We find that TRADES uses weight decay of 2× 10−4 , Gaussian PGD initialization as δ0 ∼ N ( 0 , αI ) , and eval mode of batch normalization ( BN ) when crafting adversarial examples , while Rice et al . ( 2020 ) use weight decay of 5× 10−4 , uniform PGD initialization as δ0 ∼ U ( − , ) , and train mode of BN to generate adversarial examples . In our experiments on CIFAR-10 ( e.g. , Table 8 ) , the two slightly different settings can differ the robust accuracy by ∼ 5 % , which is significant according to the reported benchmarks . To have a comprehensive study , we further investigate the implementation details of tens of papers working on the AT methods , some of which are summarized in Table 1 . We find that even using the same model architectures , the basic hyperparameter settings ( e.g. , weight decay , learning rate schedule , etc . ) used in these papers are highly inconsistent and customized , which could affect the model performance and may override the gains from the methods themselves . Under this situation , if we directly benchmark these methods using their released code or checkpoints , some actually effective improvements would be under-estimated due to the improper hyperparameter settings . Our contributions . We evaluate the effects of a wide range of basic training tricks ( e.g. , warmup , early stopping , weight decay , batch size , BN mode , etc . ) on the adversarially trained models . Our empirical results suggest that improper training settings can largely degenerate the model performance , ∗Corresponding author . 1Code is available at https : //github.com/P2333/Bag-of-Tricks-for-AT while this degeneration may be mistakenly ascribed to the methods themselves . We provide a baseline recipe for PGD-AT on CIFAR-10 as an example , and demonstrate the generality of the recipe on training other frameworks like TRADES . As seen in Table 16 , the retrained TRADES achieve new state-of-the-art performance on the AutoAttack benchmark ( Croce & Hein , 2020b ) . Although our empirical conclusions may not generalize to other datasets or tasks , we reveal the facts that adversarially trained models could be sensitive to certain training settings , which are usually neglected in previous work . These results also encourage the community to re-implement the previously proposed defenses with fine-tuned training settings to better explore their potentials . 2 RELATED WORK . In this section , we introduce related work on the adversarial defenses and recent benchmarks . We detail on the adversarial attacks in Appendix A.1 . 2.1 ADVERSARIAL DEFENSES . To alleviate the adversarial vulnerability of deep learning models , many defense strategies have been proposed , but most of them can eventually be evaded by adaptive attacks ( Carlini & Wagner , 2017b ; Athalye et al. , 2018 ) . Other more theoretically guaranteed routines include training provably robust networks ( Dvijotham et al. , 2018a ; b ; Hein & Andriushchenko , 2017 ; Wong & Kolter , 2018 ) and obtaining certified models via randomized smoothing ( Cohen et al. , 2019 ) . While these methods are promising , they currently do not match the state-of-the-art robustness under empirical evaluations . The idea of adversarial training ( AT ) stems from the seminal work of Goodfellow et al . ( 2015 ) , while other AT frameworks like PGD-AT ( Madry et al. , 2018 ) and TRADES ( Zhang et al. , 2019b ) occupied the winner solutions in the adversarial competitions ( Kurakin et al. , 2018 ; Brendel et al. , 2020 ) . Based on these primary AT frameworks , many improvements have been proposed via encoding the mechanisms inspired from other domains , including ensemble learning ( Tramèr et al. , 2018 ; Pang et al. , 2019 ) , metric learning ( Mao et al. , 2019 ; Li et al. , 2019 ; Pang et al. , 2020c ) , generative modeling ( Jiang et al. , 2018 ; Pang et al. , 2018b ; Wang & Yu , 2019 ; Deng et al. , 2020 ) , semisupervised learning ( Carmon et al. , 2019 ; Alayrac et al. , 2019 ; Zhai et al. , 2019 ) , and self-supervised learning ( Hendrycks et al. , 2019 ; Chen et al. , 2020a ; b ; Naseer et al. , 2020 ) . On the other hand , due to the high computational cost of AT , many efforts are devoted to accelerating the training procedure via reusing the computations ( Shafahi et al. , 2019b ; Zhang et al. , 2019a ) , adaptive adversarial steps ( Wang et al. , 2019 ; Zhang et al. , 2020 ) or one-step training ( Wong et al. , 2020 ; Liu et al. , 2020 ; Vivek B & Venkatesh Babu , 2020 ) . The following works try to solve the side effects ( e.g. , catastrophic overfitting ) caused by these fast AT methods ( Andriushchenko & Flammarion , 2020 ; Li et al. , 2020 ) . 2.2 ADVERSARIAL BENCHMARKS . Due to the large number of proposed defenses , several benchmarks have been developed to rank the adversarial robustness of existing methods . Dong et al . ( 2020 ) perform large-scale experiments to generate robustness curves , which are used for evaluating typical defenses . Croce & Hein ( 2020b ) propose AutoAttack , which is an ensemble of four selected attacks . They apply AutoAttack on tens of previous defenses and provide a comprehensive leader board . Chen & Gu ( 2020 ) propose the black-box RayS attack , and establish a similar leader board for defenses . In this paper , we mainly apply PGD attack and AutoAttack as two common ways to evaluate the models . Except for the adversarial robustness , there are other efforts that introduce augmented datasets for accessing the robustness against general corruptions or perturbations . Mu & Gilmer ( 2019 ) introduce MNIST-C with a suite of 15 corruptions applied to the MNIST test set , while Hendrycks & Dietterich ( 2019 ) introduce ImageNet-C and ImageNet-P with common corruptions and perturbations on natural images . Evaluating robustness on these datasets can reflect the generality of the proposed defenses , and avoid overfitting to certain attacking patterns ( Engstrom et al. , 2019 ; Tramèr & Boneh , 2019 ) . 3 BAG OF TRICKS . Our overarching goal is to investigate how the usually overlooked implementation details affect the performance of the adversarially trained models . Our experiments are done on CIFAR-10 ( Krizhevsky & Hinton , 2009 ) under the ` ∞ threat model of maximal perturbation = 8/255 , without accessibility to additional data . We evaluate the models under 10-steps PGD attack ( PGD-10 ) ( Madry et al. , 2018 ) and AutoAttack ( AA ) ( Croce & Hein , 2020b ) . For the PGD attack , we apply untargeted mode using ground truth labels , step size of 2/255 , and 5 restarts for evaluation / no restart for training . For the AutoAttack2 , we apply the standard version , with no restart for AutoPGD and FAB , compared to 5 restarts for plus version . We consider some basic training tricks and perform ablation studies on each of them , based on the default training setting as described below : Default setting . Following Rice et al . ( 2020 ) , in the default setting , we apply the primary PGD-AT framework and the hyperparameters including batch size 128 ; SGD momentum optimizer with the initial learning rate of 0.1 ; weight decay 5× 10−4 ; ReLU activation function and no label smoothing ; train mode for batch normalization when crafting adversarial examples . All the models are trained for 110 epochs with the learning rate decaying by a factor of 0.1 at 100 and 105 epochs , respectively . We report the results on the checkpoint with the best PGD-10 accuracy . Note that our empirical observations and conclusions may not always generalize to other datasets or AT frameworks , but we emphasize the importance of using consistent implementation details ( not only the same model architectures ) to enable fair comparisons among different AT methods . 2https : //github.com/fra31/auto-attack 256 83.33 52.20 82.24 52.52 . 512 83.40 50.69 82.16 53.36 . 256 86.21 52.90 85.89 56.09 . 3.1 EARLY STOPPING AND WARMUP . Early stopping training epoch . The trick of early stopping w.r.t . the training epoch was first applied in the implementation of TRADES ( Zhang et al. , 2019b ) , where the learning rate decays at the 75th epoch and the training is stopped at the 76th epoch . Later Rice et al . ( 2020 ) provide a comprehensive study on the overfitting phenomenon in AT , and advocate early stopping the training epoch as a general strategy for preventing adversarial overfitting , which could be triggered according to the PGD accuracy on a split validation set . Due to its effectiveness , we regard this trick as a default choice . Early stopping adversarial intensity . Another level of early stopping happens on the adversarial intensity , e.g. , early stopping PGD steps when crafting adversarial examples for training . This trick was first applied by the runner-up of the defense track in NeurIPS 2018 adversarial vision challenge ( Brendel et al. , 2020 ) . Later efforts are devoted to formalizing this early stopping mechanism with different trigger rules ( Wang et al. , 2019 ; Zhang et al. , 2020 ) . Balaji et al . ( 2019 ) early stop the adversarial perturbation , which has a similar effect on the adversarial intensity . In the left part of Table 2 , we evaluate the method proposed by Zhang et al . ( 2020 ) due to its simplicity . As seen , this kind of early stopping can improve the performance on clean data while keeping comparable accuracy under PGD-10 . However , the performance under the stronger AutoAttack is degraded . Warmup w.r.t . learning rate . Warmup w.r.t . learning rate is a general trick for training deep learning models ( Goodfellow et al. , 2016 ) . In the adversarial setting , Wong et al . ( 2020 ) show that the one cycle learning rate schedule is one of the critical ingredients for the success of FastAT . Thus , we evaluate the effect of this trick for the piecewise learning rate schedule and PGD-AT framework . We linearly increase the learning rate from zero to the preset value in the first 10 / 15 / 20 epochs . As shown in the middle part of Table 2 , the effect of warming up learning rate is marginal . Warmup w.r.t . adversarial intensity . In the AT procedure , warmup can also be executed w.r.t . the adversarial intensity . Cai et al . ( 2018 ) propose the curriculum AT process to gradually increase the adversarial intensity and monitor the overfitting trend . Qin et al . ( 2019 ) increase the maximal Epochs Epochs Figure 1 : ( a ) Test accuracy w.r.t . different values of weight decay . The reported checkpoints correspond to the best PGD-10 accuracy ( Rice et al. , 2020 ) . We test on two model architectures , and highlight ( with red circles ) three most commonly used weight decays in previous work ; ( b ) Curves of test accuracy w.r.t . training epochs , where the model is WRN-34-10 . We set weight decay be 1× 10−4 , 2× 10−4 , and 5× 10−4 , respectively . We can observe that smaller weight decay can learn faster but also more tend to overfit w.r.t . the robust accuracy . In Fig . 4 , we early decay the learning rate before the models overfitting , but weight decay of 5× 10−4 still achieve better robustness . perturbation from zero to 8/255 in the first 15 epochs . In the right part of Table 2 , we linearly increase the maximal perturbation in the first 10 / 15 / 20 epochs , while the effect is still limited .

Summary: The paper provides an evaluation of different hyperparameter settings for adversarial training. Specifically, it evaluates combinations of warmup, early stopping, weight decay, batch size and other parameters on adversarially trained models. The paper states that its overarching goal is to ``investigate how the implementation details affect the performance of the adversarial trained models''.