Robust Overfitting may be mitigated by properly learned smoothening

1 INTRODUCTION Adversarial training ( AT ) ( Madry et al. , 2018 ) , i.e. , training a deep network to minimize the worst-case training loss under input perturbations , is recognized as the current best defense method to adversarial attacks . However , one of its pitfalls was exposed by a recent work ( Rice et al. , 2020 ) : in contrast to the commonly-held belief that overparameterized deep networks hardly overfit in standard training ( Zhang et al. , 2016 ; Neyshabur et al. , 2017 ; Belkin et al. , 2019 ) , overfitting turns out to be a dominant phenomenon in adversarially robust training of deep networks . After a certain point in AT , e.g. , immediately after the first learning rate decay , the robust test errors will only continue to substantially increase with further training ( see Figure 1 bottom for example ) . That surprising phenomenon , termed as “ robust overfitting ” , has been prevalent on many datasets and models . As Rice et al . ( 2020 ) pointed out , it poses serious challenges to assess recent algorithmic ∗Equal Contribution . 1 advances upon AT : by just using an earlier checkpoint , the performance of AT be drastically boosted to match the more recently reported state-of-the-arts ( Yang et al. , 2019b ; Zhang et al. , 2019b ) . Even worse , Rice et al . ( 2020 ) tested several other implicit and explicit regularization methods , including weight decay , data augmentation and semi-supervised learning ; they reported that none of those alternatives seem to combat robust overfitting ( stably ) better than simple early stopping . The authors thus advocated using the validation set to select a stopping point , although the manual picking would inevitably trade off between selecting either the peak point of robust test accuracy or that of standard accuracy , which often do not coincide ( Chen et al. , 2020a ) . Does there exist more principled , hands-off , and hassle-free mitigation for this robust overfitting , for us to further unleash the competency of AT ? This paper explores two options along the way , that draw two more sophisticated ideas from enhancing standard deep models ’ generalization . Both could be viewed as certain types of learned smoothening , and are directly plugged into AT : • Our first approach is to smooth the logits in AT via self-training , using knowledge distillation with the same model pre-trained as a self-teacher . The idea is inspired by two facts : ( 1 ) label smoothening ( Szegedy et al. , 2016 ) can calibrate the notorious overconfidence of deep networks ( Hein et al. , 2019 ) , and that was found to improve their standard generalization ; ( 2 ) label smoothening can be viewed as a special case of knowledge distillation ( Yuan et al. , 2020 ) , and self-training can produce more semantic-aware and discriminative soft label “ self-teachers ” than naive label smoothening ( Chen et al. , 2020b ; Tang et al. , 2020 ) . • Our second approach is to smooth the weights in AT via stochastic weight averaging ( SWA ) ( Izmailov et al. , 2018 ) , a popular training technique that leads to better standard generalization than SGD , with almost no computational overhead . While SWA has not yet be applied to AT , it is known to find flatter minima which are widely believed to indicate stronger robustness ( Hein & Andriushchenko , 2017 ; Wu et al. , 2020a ) . Meanwhile , SWA could also be interpreted as a temporal model ensemble , and therefore might bring the extra robustness of ensemble defense ( Tramèr et al. , 2018 ; Grefenstette et al. , 2018 ) with the convenience of a single model . Those suggest that applying SWA is natural and promising for AT . To be clear , neither knowledge-distillation/self-training nor SWA was invented by this paper : they have been utilized in standard training to alleviate ( standard ) overfitting and improve generalization , by fixing over-confidence and by finding flatter solutions , respectively . By introducing and adapting them to AT , our aim is to complement the existing study , demonstrating that while simpler regularizations were unable to fix robustness overfitting as Rice et al . ( 2020 ) found , our learned logit/weight smoothening could effectively regularize and mitigate it , without needing early stopping . Experiments demonstrate that by plugging in the two techniques to AT , we can simultaneously boost the standard accuracy by 3.72 % ∼ 6.68 % and robust accuracy by 0.22 % ∼ 2.03 % , across multiple datasets ( STL-10 , SVHN , CIFAR-10 , CIFAR-100 , and Tiny ImageNet ) , perturbation types ( ` ∞ and ` 2 ) , and robustified methods ( PGD , TRADES , and FSGM ) , establishing the new state-of-the-art in AT . As shown in Figure 1 example , our method eliminates the robust overfitting phenomenon in AT , even when training up to 200 epochs . Our results imply that although robustness overfitting is more challenging than standard overfitting , its mitigation is still feasible with properly-chosen , advanced regularizations that were developed for the latter . Overall , our findings join ( Rice et al. , 2020 ) in re-establishing the competitiveness of the simplest AT baseline . 1.1 BACKGROUND WORK . Deep networks are easily fooled by imperceivable adversarial samples . To tackle this vulnerability , numerous defense methods were proposed ( Goodfellow et al. , 2015 ; Kurakin et al. , 2016 ; Madry et al. , 2018 ) , yet many of them ( Liao et al. , 2018 ; Guo et al. , 2018 ; Xu et al. , 2017 ; Dziugaite et al. , 2016 ; Dhillon et al. , 2018 ; Xie et al. , 2018 ; Jiang et al. , 2020 ) were later found to result from training artifacts , such as obfuscated gradients ( Athalye et al. , 2018 ) caused by input transformation or randomization . Among them , adversarial training ( AT ) ( Madry et al. , 2018 ) remains one of the most competitive options . Recently more improved defenses have been reported ( Dong et al. , 2018 ; Yang et al. , 2019b ; Mosbach et al. , 2018 ; Hu et al. , 2020 ; Wang et al. , 2020a ; Dong et al. , 2020 ; Zhang et al. , 2020a ; b ) , with some of them also being variants of AT , e.g . TRADES ( Zhang et al. , 2019b ) and AT with metric learning regularizers ( Mao et al. , 2019 ; Pang et al. , 2019 ; 2020 ) . While overfitting has become less a practical concern in training deep networks nowadays , it was not yet noticed nor addressed in the adversarial defense field until lately . An overfitting phenomenon was 2 first observed in a few fast adversarial training methods ( Zhang et al. , 2019a ; Shafahi et al. , 2019b ; Wong et al. , 2020 ) based on FGSM ( Goodfellow et al. , 2015 ) , e.g. , sometimes the robust accuracy against a PGD adversary suddenly drop to nearly zero after some training . ( Andriushchenko & Flammarion , 2020 ) suggested it to be rooted in those methods ’ local linearization assumptions of the loss landscape in those “ fast ” AT . The recently reported robust overfitting ( Rice et al. , 2020 ) seems to raise a completely new challenge for the classical AT ( not fast ) : the model starts to irreversibly lose robustness after training with AT for a period , even the double-descent generalization curves still seemed to hold ( Belkin et al. , 2019 ; Nakkiran et al. , 2019 ) . Among various options tried in Rice et al . ( 2020 ) , early-stopping was so far the only effective remedy found . 2 METHODOLOGY . 2.1 LEARNING TO SMOOTH LOGITS IN AT . Rationale : Why AT enforces models robust against adversarial attacks of a specific type and certain magnitudes . However , it has been shown to “ overfit ” the threat model “ seen ” during training ( Kang et al. , 2019 ; Maini et al. , 2019 ; Stutz et al. , 2020 ) , and its gained robustness does not extrapolate to larger perturbations nor unseen attack types . Stutz et al . ( 2020 ) hypothesized this to be an unwanted consequence of enforcing high-confidence predictions on adversarial examples since high-confidence predictions are difficult to extrapolate to arbitrary regions beyond the seen examples during training . We generalize this observation : during AT , the attacks generated at every iteration can be naturally considered as continuously varying/evolving , along with the model training . Therefore , we hypothesize one source of robust overfitting might lie in that the model “ overfits ” the attacks generated in the early stage of AT and fails to generalize or adapt to the attacks in the late stage . To alleviate the overconfidence problem , we adapt the label smoothening ( LS ) technique in standard training ( Szegedy et al. , 2016 ) . LS creates uncertainty in the one-hot labels , by computing crossentropy not with the “ hard ” targets from the dataset , but with a weighted mixture of these one-hot targets with the uniform distribution . This uncertainty helps to tackle alleviate the overconfidence problem Hein et al . ( 2019 ) and improves the standard generalization . The idea of LS was previously investigated in other defense methods ( Shafahi et al. , 2019a ; Goibert & Dohmatob , 2019 ) , but much of the observed robustness gains were later attributed to obfuscated gradients ( Athalye et al. , 2018 ) . Two recent works ( Stutz et al. , 2020 ; Cheng et al. , 2020 ) have integrated LS with AT to inject label uncertainty : Stutz et al . ( 2020 ) used a convex combination of uniform and one-hot distributions as target for the cross-entropy loss in AT , which resembles the LS regularizer , while Cheng et al . ( 2020 ) concurrently used an LS regularizer for AT . However , there is one pitfall of the naive LS in ( Szegedy et al. , 2016 ) : over-smoothening labels in a data-blind way could cause loss of information in the logits , and hence weakened discriminative power of the trained models ( Müller et al. , 2019 ) . That calls for a careful and adaptive balance between discriminative capability and confidence calibration of the model . In the context of AT , Stutz et al . ( 2020 ) crafted a perturbation-dependent parameter , to explicitly control the transition from one-hot to the uniform distribution when the attack magnitude grows from small to large . To identify more automated and principled means , we notice another recent work ( Yuan et al. , 2020 ) , who explicitly connected knowledge distillation ( KD ) ( Hinton et al. , 2015 ) to LS . The authors pointed out that LS equals a special case of KD using a virtual and hand-crafted teacher ; on the contrary , the conventional KD provides data-driven soften labels rather than simply mixing one-shot and uniform vectors . Together with many others ( Furlanello et al. , 2018 ; Chen et al. , 2020b ) , these works demonstrated that using model-based and learned soft labels supplies much superior confidence calibration and logit geometry compared to the naive LS ( Tang et al. , 2020 ) . Furthermore , ( Furlanello et al. , 2018 ; Chen et al. , 2020b ; Yuan et al. , 2020 ) unanimously revealed that another strong teacher model with extra privileged information is NOT critical to the success of KD . Yuan et al . ( 2020 ) shows that even a poorly-trained teacher with much lower accuracy can still improve the student . Moreover , Chen et al . ( 2020b ) ; Yuan et al . ( 2020 ) find self-teacher to be sufficiently effective for KD , that is , using soft-logit outputs from the student or designed manually as the KD regularization to train itself ( also called teacher-free KD 3 ( Tf-KD ) in ( Yuan et al. , 2020 ) ) . These observations make the main cornerstone for our learned logit smoothening approach next . Approach : How We follow ( Chen et al. , 2020b ; Yuan et al. , 2020 ) to use self-training with the same model , but introduce one specific modification . The one model could be trained with at least two different ways : standard training , or robust training ( AT or other cheaper ways ; see ablation experiments ) . That can yield two self-teachers . We assume both to be available ; and let x be the input , y the one-hot ground truth label , δ the adversarial perturbation bounded by ` p norm ball with radius , and θr/θs the weights of the robust-/standard-trained self-teachers , respectively . Note the two self-teachers share the identical network architecture and training data with our target model . Our self-training smoothed loss function is expressed below ( λ1 and λ2 are two hyperparameters ) : min θ E ( x , y ) ∈D { ( 1− λ1 − λ2 ) · max δ∈B ( x ) LXE ( f ( θ , x + δ ) , y ) + λ1 · KDadv ( f ( θ , x + δ ) , f ( θr , x + δ ) ) + λ2 · KDstd ( f ( θ , x + δ ) , f ( θs , x + δ ) ) } , ( 1 ) where LXE is robustified cross-entropy loss adopted in the original AT ; KDadv and KDstd are the Kullback–Leibler divergence loss with the robust-trained and standard-trained self-teachers , respectively . λ1 = 0.5 and λ2 = 0.25 are default in all experiments . More details are in Appendix A2.1 . Figure 2 visualizes an example of logit distributions , generated by naive LS ( Szegedy et al. , 2016 ) , the Tf-KD regularizer using manually-designed self-teacher in ( Yuan et al. , 2020 ) , as well our standard- and robust-trained teachers , respectively . We observe both standard and robust selfteachers are more discriminative than the other two baseline smoothenings , while the robust selfteacher is relatively more conservative as one shall expect .

Summary: The paper studies a method for mitigating robust overfitting. Rice et al., and others have observed that when training a neural network robustly on say CIFAR10, then the robust test error often overfits, i.e., it has a U-shaped curve as a function of training epochs. Rice et al. demonstrated that early stopping the robust training enables state-of-the-art robust performance. However, to realize this performance, it is necessary to find a good early stopping point, which can be difficult (but can be found with testing on a validation set). The paper proposes an alternative to early stopping: smoothing the logits and smoothing the weights, by using  two existing techniques, namely self-training and stochastic weight averaging. The paper finds that smoothing mitigates robust overfitting, and reports even a slight improvement over early stopping at the optimal point.