Fast is better than free: Revisiting adversarial training

1 INTRODUCTION . Although deep network architectures continue to be successful in a wide range of applications , the problem of learning robust deep networks remains an active area of research . In particular , safety and security focused applications are concerned about robustness to adversarial examples , data points which have been adversarially perturbed to fool a model ( Szegedy et al. , 2013 ) . The goal here is to learn a model which is not only accurate on the data , but also accurate on adversarially perturbed versions of the data . To this end , a number of defenses have been proposed to mitigate the problem and improve the robustness of deep networks , with some of the most reliable being certified defenses and adversarial training . However , both of these approaches come at a non-trivial , additional computational cost , often increasing training time by an order of magnitude over standard training . This has slowed progress in researching robustness in deep networks , due to the computational difficulty in scaling to much larger networks and the inability to rapidly train models when experimenting with new ideas . In response to this difficulty , there has been a recent surge in work ∗Equal contribution . that tries to to reduce the complexity of generating an adversarial example , which forms the bulk of the additional computation in adversarial training ( Zhang et al. , 2019 ; Shafahi et al. , 2019 ) . While these works present reasonable improvements to the runtime of adversarial training , they are still significantly slower than standard training , which has been greatly accelerated due to competitions for optimizing both the speed and cost of training ( Coleman et al. , 2017 ) . In this work , we argue that adversarial training , in fact , is not as hard as has been suggested by this past line of work . In particular , we revisit one of the the first proposed methods for adversarial training , using the Fast Gradient Sign Method ( FGSM ) to add adversarial examples to the training process ( Goodfellow et al. , 2014 ) . Although this approach has long been dismissed as ineffective , we show that by simply introducing random initialization points , FGSM-based training is as effective as projected gradient descent based training while being an order of magnitude more efficient . Moreover , FGSM adversarial training ( and to a lesser extent , other adversarial training methods ) can be drastically accelerated using standard techniques for efficient training of deep networks , including e.g . cyclic learning rates ( Smith & Topin , 2018 ) , mixed-precision training ( Micikevicius et al. , 2017 ) , and other similar techniques . The method has extremely few free parameters to tune , and can be easily adapted to most training procedures . We further identify a failure mode that we call “ catastrophic overfitting ” , which may have caused previous attempts at FGSM adversarial training to fail against PGD-based attacks . The end result is that , with these approaches , we are able to train ( empirically ) robust classifiers far faster than in previous work . Specifically , we train an ` ∞ robust CIFAR10 model to 45 % accuracy at = 8/255 ( the same level attained in previous work ) in 6 minutes ; previous papers reported times of 80 hours for PGD-based training ( Madry et al. , 2017 ) and 10 hours for the more recent “ free ” adversarial training method ( Shafahi et al. , 2019 ) . Similarly , we train an ` ∞ robust ImageNet classifier to 43 % top-1 accuracy at = 2/255 ( again matching previous results ) in 12 hours of training ( compared to 50 hours in the best reported previous work that we are aware of ( Shafahi et al. , 2019 ) ) . Both of these times roughly match the comparable time for quickly training a standard non-robust model to reasonable accuracy . We extensively evaluate these results against strong PGDbased attacks , and show that they obtain the same empirical performance as the slower , PGD-based training . Thus , we argue that despite the conventional wisdom , adversarially robust training is not actually more challenging than standard training of deep networks , and can be accomplished with the notoriously weak FGSM attack . 2 RELATED WORK . After the discovery of adversarial examples by Szegedy et al . ( 2013 ) , Goodfellow et al . ( 2014 ) proposed the Fast Gradient Sign Method ( FGSM ) to generate adversarial examples with a single gradient step . This method was used to perturb the inputs to the model before performing backpropagation as an early form of adversarial training . This attack was enhanced by adding a randomization step , which was referred to as R+FGSM ( Tramèr et al. , 2017 ) . Later , the Basic Iterative Method improved upon FGSM by taking multiple , smaller FGSM steps , ultimately rendering both FGSM-based adversarial training ineffective ( Kurakin et al. , 2016 ) . This iterative adversarial attack was further strengthened by adding multiple random restarts , and was also incorporated into the adversarial training procedure . These improvements form the basis of what is widely understood today as adversarial training against a projected gradient descent ( PGD ) adversary , and the resulting method is recognized as an effective approach to learning robust networks ( Madry et al. , 2017 ) . Since then , the PGD attack and its corresponding adversarial training defense have been augmented with various techniques , such as optimization tricks like momentum to improve the adversary ( Dong et al. , 2018 ) , combination with other heuristic defenses like matrix estimation ( Yang et al. , 2019 ) or logit pairing ( Mosbach et al. , 2018 ) , and generalization to multiple types of adversarial attacks ( Tramèr & Boneh , 2019 ; Maini et al. , 2019 ) . In addition to adversarial training , a number of other defenses against adversarial attacks have also been proposed . Adversarial defenses span a wide range of methods , such as preprocessing techniques ( Guo et al. , 2017 ; Buckman et al. , 2018 ; Song et al. , 2017 ) , detection algorithms ( Metzen et al. , 2017 ; Feinman et al. , 2017 ; Carlini & Wagner , 2017a ) , verification and provable defenses ( Katz et al. , 2017 ; Sinha et al. , 2017 ; Wong & Kolter , 2017 ; Raghunathan et al. , 2018 ) , and various theoretically motivated heuristics ( Xiao et al. , 2018 ; Croce et al. , 2018 ) . While certified defenses have been scaled to reasonably sized networks ( Wong et al. , 2018 ; Mirman et al. , 2018 ; Gowal et al. , 2018 ; Cohen et al. , 2019 ; Salman et al. , 2019 ) , the guarantees don ’ t match the empirical robustness obtained through adversarial training . With the proposal of many new defense mechanisms , of great concern in the community is the use of strong attacks for evaluating robustness : weak attacks can give a misleading sense of security , and the history of adversarial examples is littered with adversarial defenses ( Papernot et al. , 2016 ; Lu et al. , 2017 ; Kannan et al. , 2018 ; Tao et al. , 2018 ) which were ultimately defeated by stronger attacks ( Carlini & Wagner , 2016 ; 2017b ; Athalye et al. , 2017 ; Engstrom et al. , 2018 ; Carlini , 2019 ) . This highlights the difficulty of evaluating adversarial robustness , as pointed out by other work which began to defeat proposed defenses en masse ( Uesato et al. , 2018 ; Athalye et al. , 2018 ) . Since then , several best practices have been proposed to mitigate this problem ( Carlini et al. , 2019 ) . Despite the eventual defeat of other adversarial defenses , adversarial training with a PGD adversary remains empirically robust to this day . However , running a strong PGD adversary within an inner loop of training is expensive , and some earlier work in this topic found that taking larger but fewer steps did not always significantly change the resulting robustness of a network ( Wang , 2018 ) . To combat the increased computational overhead of the PGD defense , some recent work has looked at regressing the k-step PGD adversary to a variation of its single-step FGSM predecessor called “ free ” adversarial training , which can be computed with little overhead over standard training by using a single backwards pass to simultaneously update both the model weights and also the input perturbation ( Shafahi et al. , 2019 ) . Finally , when performing a multi-step PGD adversary , it is possible to cut out redundant calculations during backpropagation when computing adversarial examples for additional speedup ( Zhang et al. , 2019 ) . Although these improvements are certainly faster than the standard adversarial training procedure , they are not much faster than traditional training methods , and can still take hours to days to compute . On the other hand , top performing training methods from the DAWNBench competition ( Coleman et al. , 2017 ) are able to train CIFAR10 and ImageNet architectures to standard benchmark metrics in mere minutes and hours respectively , using only a modest amount of computational resources . Although some of the techniques can be quite problem specific for achieving bleedingedge performance , more general techniques such as cyclic learning rates ( Smith & Topin , 2018 ) and half-precision computations ( Micikevicius et al. , 2017 ) have been quite successful in the top ranking submissions , and can also be useful for adversarial training . 3 ADVERSARIAL TRAINING OVERVIEW . Adversarial training is a method for learning networks which are robust to adversarial attacks . Given a network fθ parameterized by θ , a dataset ( xi , yi ) , a loss function ` and a threat model ∆ , the learning problem is typically cast as the following robust optimization problem , min θ ∑ i max δ∈∆ ` ( fθ ( xi + δ ) , yi ) . ( 1 ) A typical choice for a threat model is to take ∆ = { δ : ‖δ‖∞ ≤ } for some > 0 . This is the ` ∞ threat model used by Madry et al . ( 2017 ) and is the setting we study in this paper . The procedure for adversarial training is to use some adversarial attack to approximate the inner maximization over ∆ , followed by some variation of gradient descent on the model parameters θ . For example , one of the earliest versions of adversarial training used the Fast Gradient Sign Method to approximate the inner maximization . This could be seen as a relatively inaccurate approximation of the inner maximization for ` ∞ perturbations , and has the following closed form ( Goodfellow et al. , 2014 ) : δ ? = · sign ( ∇x ` ( f ( x ) , y ) ) . ( 2 ) A better approximation of the inner maximization is to take multiple , smaller FGSM steps of size α instead . When the iterate leaves the threat model , it is projected back to the set ∆ ( for ` ∞ perturbations . This is equivalent to clipping δ to the interval [ − , ] ) . Since this is only a local approximation of a non-convex function , multiple random restarts within the threat model ∆ typically improve the approximation of the inner maximization even further . A combination of all these techniques is Algorithm 1 PGD adversarial training for T epochs , given some radius , adversarial step size α and N PGD steps and a dataset of size M for a network fθ for t = 1 . . . T do for i = 1 . . .M do // Perform PGD adversarial attack δ = 0 // or randomly initialized for j = 1 . . . N do δ = δ + α · sign ( ∇δ ` ( fθ ( xi + δ ) , yi ) ) δ = max ( min ( δ , ) , − ) end for θ = θ −∇θ ` ( fθ ( xi + δ ) , yi ) // Update model weights with some optimizer , e.g . SGD end for end for Algorithm 2 “ Free ” adversarial training for T epochs , given some radius , N minibatch replays , and a dataset of size M for a network fθ δ = 0 // Iterate T/N times to account for minibatch replays and run for T total epochs for t = 1 . . . T/N do for i = 1 . . .M do // Perform simultaneous FGSM adversarial attack and model weight updates T times for j = 1 . . . N do // Compute gradients for perturbation and model weights simultaneously ∇δ , ∇θ = ∇ ` ( fθ ( xi + δ ) , yi ) δ = δ + · sign ( ∇δ ) δ = max ( min ( δ , ) , − ) θ = θ −∇θ // Update model weights with some optimizer , e.g . SGD end for end for end for known as the PGD adversary ( Madry et al. , 2017 ) , and its usage in adversarial training is summarized in Algorithm 1 . Note that the number of gradient computations here is proportional to O ( MN ) in a single epoch , where M is the size of the dataset and N is the number of steps taken by the PGD adversary . This is N times greater than standard training ( which has O ( M ) gradient computations per epoch ) , and so adversarial training is typically N times slower than standard training .

Summary: The authors claimed a classic adversarial training method, FGSM with random start, can indeed train a model that is robust to strong PGD attacks. Moreover, when it is combined with some fast  training methods, such as cyclic learning rate scheduling and mixed precision, the adversarial training time can be significantly decreased. The experiment verifies the authors' claim convincingly.