Amata: An Annealing Mechanism for Adversarial Training Acceleration
Authors: Nanyang Ye
Qianxiao Li
Zhanxing Zhu
Venue:  (2020)

Abstract: Despite of the empirical success in various domains, it has been revealed that deep neural networks are vulnerable to maliciously perturbed input data that much degrade their performance. This is known as adversarial attacks. To counter adversarial attacks, adversarial training formulated as a form of robust optimization has been demonstrated to be effective. However, conducting adversarial training brings much computational overhead compared with standard training. In order to reduce the computational cost, we propose a simple yet effective modification to the commonly used projected gradient descent (PGD) adversarial training by increasing the number of adversarial training steps and decreasing the adversarial training step size gradually as training proceeds. We analyze the optimality of this annealing mechanism through the lens of optimal control theory, and we also prove the convergence of our proposed algorithm. Numerical experiments on standard datasets, such as MNIST and CIFAR10, show that our method can achieve similar or even better robustness with around 1/3 to 1/2 computation time compared with PGD.

Under review as a conference paper at ICLR 2020
AMATA: AN ANNEALING MECHANISM FOR ADVER- SARIAL TRAINING ACCELERATION
Anonymous authors Paper under double-blind review
ABSTRACT
Despite of the empirical success in various domains, it has been revealed that deep neural networks are vulnerable to maliciously perturbed input data that much de- grade their performance. This is known adversarial attacks. To counter ad- versarial attacks, adversarial training formulated as form of robust optimization has been demonstrated to be effective. However, conducting adversarial training brings much computational overhead compared with standard training. In order reduce the computational cost, we propose simple yet effective modification to the commonly used projected gradient descent (PGD) adversarial training by increasing the number of adversarial training steps and decreasing the adversar- ial training step size gradually training proceeds. We analyze the optimality this annealing mechanism through the lens of optimal control theory, and we also prove the convergence of our proposed algorithm. Numerical experiments on standard datasets, such as MNIST and CIFARIO, show that our method can achieve similar even better robustness with around 1/3 to 1/2 computation time compared with PGD.
INTRODUCTION
Recently, the revival of deep neural networks has led to breakthroughs in various fields, including computer vision, natural language processing, game playing, etc. Despite these advancements, deep neural networks were found to be vulnerable to malicious perturbations on the original input data. While the perturbations remain almost imperceptible to humans, they can lead to wrong predictions over the perturbed examples (Szegedy al. 2013 Goodfellow et al., 2014; Akhtar Mian 2018). These maliciously crafted examples are known as adversarial examples. which have caused serious concerns over the reliability and security of deep learning systems, particularly when deployed in the life-critical scenarios, such as autonomous driving systems and health/medical domains.
Several defense mechanisms have been proposed, such as input reconstruction (Meng & Chen 2017 Song et al. 2018). input encoding (Buckman et al.] 2018). and adversarial training (Goodrellow eet al. 2014; Tramèr et al.) 2017: He et al. 2017 Madry et al. 2017). Among these methods, adversarial training the most effective defense method so far. Adversarial training can be posed as a robust optimization problem (Ben- Tal & Nemirovski, 1998), where a min-max optimization problem is solved (Madry et al. [017]] Kolter & Wong 2017). For example, given C-class dataset = [xx v.)) with X E RR as a normal or clean example in the d-dimensional input space and y: E RC as its associated one-hot label, the objective of adversarial training is to solve the following min-max optimization problem:
N
min N
Σ max
((ho (s)
(1)
where he Rd - RC is the deep neural network (DNN) function, é is the loss function and is the maximum perturbation constraint. The inner maximization problem to find an adversarial example x,, within the c-ball around given normal example x"! that maximizes the classification loss f. On the other hand, the outer minimization problem to find model parameters that minimizes the loss l on the adversarial examples {x:)²_ that are generated from the inner maximization.
The inner maximization problem is commonly solved by projected gradient descent (PGD). PGD perturbs normal example x by iteratively updating it in the steepest ascent direction for total

---

Under review as a conference paper at ICLR 2020
of K times. Each ascent step is modulated by small step size and projection step back onto the e-ball of x" to prevent the updated value fall outside the e-ball of x" (Madry et al. 2017):
x² [xx
sign( V (
where a is the step size, II(.) is the orthogonal projection function onto (x': : ||x00 x'1l sc), and x is the adversarial example at k-th step.
However, major problem prohibiting adversarial training to be practically applicable is the huge computational burden associated with the inner maximization steps: need to iteratively solve the inner maximization problem to find good adversarial examples for DNN to be robust. Recently, to accelerate adversarial training, a few methods have been proposed. For example, YOPO estimat- ed the gradient on the input by only propagating the first layer (Zhang et al.) 2019a). and parallel adversarial training utilized multiple graphics computation units (GPUs) for acceleration (Bhat & Tsipras] 2019; SSaarhii et al., 2019). A common drawback of these methods are their implementa- tion complexity or their need for multiple GPUs for acceleration. On the other hand, empirical observation made by (Wang et al. 2019), indicated that we might not need to find good solutions to the inner maximization at the initial stages of adversarial training achieve even better robustness.
In line of such observations, in this paper we propose a simple yet effective Annealing Mechanism for Adversarial Training Acceleration, which we call Amata, that gradually controls the degree of which the inner maximization is solved as the training proceeds. This annealing algorithm only takes 1/3 to 1/2 the time achieve comparable or even better robustness with the addition of only two lines of code. To motivate the present approach, we develop a general formulation of adversarial training as an optimal control problem, from which an approximate optimality criterion can be derived based the Pontryagin's 's maximum principle. This criterion is related to but different from the empirical FOSC criterion (Wang et al., 2019) that improves the robustness of adversarial training by determining the number of adversarial training steps according to the empirical criterion. We will also demonstrate in our experiments that unlike FOSC, algorithms derived from our proposed criterion leads to acceleration.
Our contributions are as follows:
1. We propose adversarial training algorithm, Amata, that gradually increases the number of iterations and decreases the step size for the inner maximization. We show that compara- ble even better robustness can be achieved with much reduced computational overhead. We also prove the convergence of our algorithm.
2. To obtain more theoretical insight, we develop a general formulation of adversarial training subject to hyper-parametee in the inner maximization loop as an optimal control problem. This includes the PGD-based methods considered in this work, but potentially encompasses
a larger class of annealed or adaptive adversarial training algorithms.
3. Using the Pontryagin's 's maximum principle from optimal control theory, we provide a prin- cipled criterion measure the near-term optimality of an annealing schedule for inner max- imization, thereby guiding and validating our proposed algorithm in balancing the trade-off between robustness and computational cost.
2 ACCELERATING ADVERSARIAL TRAINING BY ANNEALING MECHANISM
In this section, we will first introduce the proposed adversarial training algorithm, which aims to balance the computational cost and the accuracy solving inner maximization. A proof of the convergence of the algorithm can be found in the Appendix. We then develop a general optimal control formulation adversarial training and derive a criterion based on the Pontryagin's 's maximum principle (Boltyanskii et al. 1960). The criterion is shown to be effective in quantifying adversarial training performance both on accuracy and computational efficiency, justifying the superiority of the proposed algorithm.
2.1 PROPOSED ANNEALING ADVERSARIAL. TRAINING ALGORITHM
The proposed adversarial training algorithm Amata is found in Algorithm T Compared with PGD, only need to add two lines of code that shown in blue. The intuition behind Amata is that, at
2

---

Under review as a conference paper at ICLR 2020
the initial stage, the neural network focus on learning features, which might not require very accurate adversarial examples. Therefore, we only need coarse approximations of the inner maximization problem solutions. With this consideration, step size for inner maximization, and then gradually increase K and decreases a to improve the quality of inner maximization solutions. This adaptive annealing mechanism would largely reduce the computational cost in the early iterations while still maintaining reasonable accuracy for the entire optimization.
set small number of update steps but with large
Algorithm 1 Amata: an annealing mechanism for adversarial training acceleration
Input: T:training epochs; m the minimum number of adversarial perturbations; K Kmax the maximum number of adversarial perturbations; parameter of neural network be adversari- ally trained; B:mini-batch; a: adversarial training time step; vy: learning rate of neural network parameters. т: constant, maximum perturbation:e.
Initialization 0 = 0 for t = 0 to T - do
Compute the annealing number of adversarial perturbations:
Kmin (Kmax Kmin) t
Kt
T
Compute adversarial perturbation step size: a² = K for each mini-batch Xg do for 1: = to K do
Compute adversarial perturbations:
xg x k-1 + ar (xl(VVe(
x = clip(xx (x x3
e, x + E)
end for 0.+1 0, (ol ), (,
end for end for Collect 07 as the parameter of wwreeeerrrilllyttrinneee neural network.
In the following section, develop a general formulation of adversarial training based on optimal control theory and derive a novel criterion to quantify the optimality of a training strategy, taking into account the trade-off between accuracy and efficiency. Importantly, we show that our propos- al, Amata, performs favorably under this criterion, thus providing theoretical justification for our approach.
2.2 OPTIMAL CONTROL FORMULATION OF ADVERSARIAL TRAINING
In essence, the PGD-based adversarial training algorithm (addr et al. 2017) represents a sequence of relaxations of the original min-max problem (T). First, the outer minimization over 0 is replaced by gradient descent. Then, a full solution of the inner maximization is replaced by a number of PGD steps in the steepest ascent direction. Consequently, natural question is how to choose the number of steps, the step size or any other hyper-parameter associated with this relaxed version of the inner maximization, and how their choices affect the performance of the overall algorithm. This is the central point of analysis in this paper and the basis of the algorithm proposed. It turns out that this question can be systematically formulated in the framework of optimal control theory (Bertsekas) 1995). We now introduce the general setup of our problem and establish connections with optimal control, and in particular the classical maximum principle in the calculus of variations.
For simplicity of presentation, let us consider just one fixed input-label pair (x", since the n- sample case is similar. The original min-max adversarial training problem
min
((h(zz) v).
(3)
(z:l|z-x0 Se)
3

---

Under review as a conference paper at ICLR 2020
The first relaxation is to replace the outer minimization with gradient descent so that obtain the iteration
0+1 = 0 - Vo
max {2:1|z [s+)
(ho, (z), y).
(4)
Then, the remaining maximization in each outer iteration step is replaced by an abstract algorithm
Au,a : Rd Rd
(5)
which solves the inner maximization approximately. Here, we assume that the algorithm depends on the parameters of our neural network, as well as appee-prrameters which takes values in closed subset of a Euclidean space. No further assumptions placed on G, which may be continuum, discrete set, or even finite set.
This relaxation leads to the following general iterations
0 = 0, - (Ae,....))
(6)
Observe that Algorithm is a particular realization of (6) where Ae.... represents the inner PGD loop and {ay, K* the hyper-parameters we pick each I. Nevertheless, Equation (6)
represents a general formulation an inner-outer loop adversarial training algorithm. For small T/ replace (6) by ordinary differential equation with the identification Ri bn::
0, = -Ve(he,, (A,,.
Formulated this way, it is immediately clear that we can approach this problem from control perspective: the dynamics of the trainable parameters are given by ( and the hyper-parameter choices at each inner algorithm u, are the controls.
Our goal is two-fold: on training interval [Ti, in the outer loop. we want to minimize some loss under adversarial training measured by real-valued function ((0) while minimizing training cost associated with each inner algorithm loop under the hyper-parameter u, which is measured by another real-valued function R(u). We thus arrive at the general optimal control formulation of our problem:
( T
min ur,
Φ(O)) +
R(u,)ds
subject to:
ELA
JT
(8)
F u.)
where
F(O,, u,) Vol(ho, (.).).))))),
where we have defined the shorthand uT = [u; : [2]} (T) and Li == ([T,, T2], G). In this paper, we take & to be the DNN's prediction loss given the adversarial example (adversarial robustness), and R is set as >K* where y is the coefficient for adversarial robustness and training time trade-off. This is account for the fact that when K" increases, the cost of the inner loop training increases accordingly. The integral over t of R is taken so as to account for the total com- putational cost corresponding choice of hyper-parameters (u,). The objective function taken as a sum serves to balance the adversarial robustness and computational cost, with a balancing coefficient.
2.3 PONTRYAGIN'S MAXIMUM PRINCIPLE
In the last section, the problem of choosing hyper-paue pareerrarmettes in the inner loops of adversarial train- ing has been formulated as an optimal control problem in (8) Now, we show how this connection can help us design and validate algorithms.
A classical result in calculus of variations gives the following necessary conditions for optimality. For more background on the theory of calculus variations and optimal control, we refer the reader to Boltyanskii al. (1960); Bertsekas et al. (1995).
Herr we assume that the gradient with respect to 0 is the partial derivative with respect to the parameters of the network ho and 0g in Ao, is held constant. This is the case for the PGD algorithm. Alternativel,, also take the total derivative, but this leads to different algorithms.
4

---

choice ur,r, over the Under review as a conference paper at ICLR 2020
Theorem 1 (Pontryagin's Maximum Principle (PMP) (Boltyanskii al. 1960)). Let ui, :T L. TT be a solution to 8 Suppose F(O,1) u) is Lipschitz in and measurable in Define the
Hamiltonian function
H p. u) =p" F(0, -R(u)
(9)
Then, there exists an absolutely continuous co-state process PT,,T, such that
0% F(0"; u2) p = VoH ; P., u H(O,, P u²) 2 H HO'
0f OT Př; - VoD for all v E G, E [Ti, T2]
(10)
(11)
(12)
In short, the maximum principle says that a set of optimal parameter choices {u;} (in our specific application, these are the optimal choices of inner-loop syper-parameters as the training proceeds) must globally maximize the Hamiltonian defined above for each outer iteration. This statement especially appealing for application because unlike first-order gradient conditions, the PMP holds even when our syper-parameten can only take discrete set of values, or when there are non- trivial constraints amongst them. The maximization criterion holds generally under these conditions. Moreover, we now show that it gives us a quantitative measure of deviation from optimality, from which we can analyze and design algorithms.
Quantitative Measure of Sub-optimality. Given any
training interval, let us define "distance" from optimality as
T2 C(unaa)): = T2 Tı J
max ( p.. v) H(0.. p. u,)ds VEG
(13)
where (0 PM E [T. T2]} represents the solution of the equations (10) and TT) with u, in place of --- Observe that C(UT, 2 for any un: .Ts with equality if and only if uT; satisfies the PMP for almost every E [Ti, Hence, C' can be used as a measure of sub-optimality. When C small, our annealing strategy {u,} is close to least locally optimal strategy, where as when it is large, our annealing strategy is far from an optimal one.
One-step Approximation and Adversarial Training Criterion. Equation 13] requires informa- tion on the entire training interval and may be expensive to compute. In this paper, we one-step approximation where we take Tj
(current iteration) and T2 = + 7) with 7/ < 1. this small interval, we also take u, be constant and thus equal to some greedy approximation, where we evaluate in the immediate short term the optimality of a piece-wise constant choice of dyper-parameee particular choices of and R (See Appendix D
This is in some sense
From (13) we then obtain via Taylor expansion and our
C(urato) =C(u,, o(1) with
C(u, t) = CCa,,, K*, max (lVoo(ho. [oo. (x) w)12 }K}
(14)
a.K
([Vool(ho, an R (I)) -
with a0, denoting the inner PGD loop starting form with K steps and step size a. Criteri- on 14) is greedy version of the general criterion derived from the maximum principle. It can be or to find an approximately optimal hyperparameter greedily by solving C(u, t) for u, which amounts to maximizing the first term. In this paper, use Bayesian optimization to perform the maximization in (1) to evaluate and select strategies from the controllable space G.
used to either evaluate the near-term sub-optimality of some choice of hyper-parameters
Remark. By applying the method of successive approximations (MSA) (Chernousko &
Lyubushin 1982. Li et al. 2017 Li & Hao 2018 E et al. 2019), we can also obtain a solution of the PMP by iterating
arg mag .P. v),
s e [Ti T2).
(15)
Implementations be found in http://githhhh.cm//yyooooo///ppp

---

Under review as a conference paper at ICLR 2020
Subsequent work will explore adaptive adversarial training acceleration based on this approach. We remark that although we appeal to control theory tools here, the application scenario is very different from prior work in Li et al. (2017): Li & Hao 2018); ; E et al. (2019). For the latter, the controlled dynamics are idealized forward propagation through a deep neural network and the controls are the trainable weights of the network. In contrast, in the current setting the controlled dynamics the evolution of weights under gradient descent in the outer loop and controls are the hyper-parameters for the adversarial perturbation inner loop.
Wang et al. (201)) proposed an empirical criterion to measure the convergence of inner maximization:
Comparison with FOSC criterion:
FOSC(x) = = w)ll (x x., (x)(ho(x).
(16)
There are some similarities between our criterion and FOSC when we do not consider the compu- tational cost term R. For example, when the stationary saddle point is achieved, both our criterion and FOSC reach the minimum. However, our proposed criterion is quite different from FOSC the following aspects:
1. Our criterion is derived from the optimal control theory, whereas FOSC is concluded from empirical observations.
2. Our criterion takes computation costs into consideration, whereas FOSC only considers the convergence of adversarial training.
3. Our criterion is based the gradient of DNN parameters, whereas FOSC is based on the gradient of the input. Measuring the gradient of DNN parameters is arguably more suitable for considering gouuttess-ttrining time trade-off as the variance of the DNN parameters is much larger than the input during training.
2.4 NUMERICAL JUSTIFICATION OF AMATA
For simple linear-quadratic control problems, we can typically derive some analytical representa- tions of an optimal control. However, for highly-nonconvex DNNs, we can only use a numerical form of the optimal control criterion (Equation 14) to analyze Amata for robustness and compu- tational efficiency trade-off. We use the LeNet neural network for MNIST classification as an example.
As a sanity check, we first consider only adversarial robustness and neglect computational cost by setting ? and use the criterion evaluate different adversarial training settings for PGD. Recalling Algorithm [ we will vary the other hyper-parameters in the inner loop: (step-size of PGD) and K (number of PGD steps). In each case, we compute the optimal control criterion values on the training dataset and evaluate the adversarially trained networks' performance against PGD-40 attack on the test dataset.
Sanity check In this case, fix K 5 and set in [0.01, 0.02, 0.03, 0.04, 0.05].
Sanity check In this case, we fix a = 0.01 and set K in [5, 10, 20, 30, 40, 50).
The results shown in Figure (a)(b) where robustness is the prediction accuracy of the trained networks under PGD-40 attack on the test dataset.
From these results, we observe that the robustness and the criterion value C are negatively correlated under varying a and K, as expected.
Now, will the same setting sanity checks but with different values of y to numerically analyze the trade-off between robustness and training time for Amata and PGD.
Setting 1: fixed a, varying K and 7: in this case, we set a 0.01, K in [5, 20, 40) and 7 in [0.02, 0.04, 0.06, 0.08]. The result for Setting is shown in Figure (c). From this result, we can observe that with the increase of 7, reducing the computation time becomes more important. For example, when is 0.02, using PGD-40 is the best strategy (the lowest C' value). When y increases to 0.06 0.08, using PGD-20 achieves the best trade-off under the criterion.
Implementations can be found in wttpy//dhinoooooooeeeemeemeeeeem

---

Under review as a conference paper at ICLR 2020
PGD-
00
FGD44
70
Roburnnes
Relustrees
01
11.01
0.02
0.08
0.04
10
20
20
91
50
002
0.85
3.10
008
(a) Sanity check
(b) Sanity check 2
(c) Setting
Figure I: Sanity checks of the optimal control criterion (? 0),
Table 1: Comparison of adversarial training strategies.
Strategy
C(y 0.04)
C(y 0.08)
Robustness
Training time (seconds)
Amata( K min = 5. K max = 40)
0.54
1.38
91.47%
697.73
Amata( K min
10, K Kaa= 40)
0.68
1.53
91.46 %
760.16
PGD-10
7.82
7.70
68.07%
307.57
PGD-20
1.52
2.09
85.23%
567.11
PGD-40
1.20
2.19
90.56%
1086.31
Next, yy 0.04 and 0.08 and use the criterion to evaluate the Amata and compare it with other settings of PGD. It can be seen that Amata better than PGD with fixed numbers of perturbation steps. Note that Amata also achieves better robustness than the highest robustness of PGD settings (PGD-40) with 91. 91.47% adversarial accuracy compared to 90.56% adversarial accuracy.
Remark: Although computing the exact optimal control strategy for DNN adversarial training is inapplicable for real-time applications, with the criterion derived from the PMP, we are able to nu- merically compare the optimality of different adversarial training strategies. From this numerical evaluation, we have demonstrated that the proposed Amata algorithm is close to an optimal ad- versarial training strategy, at least one that satisfies the maximum principle. We will show that our algorithm can achieve similar or even better ad adversarial accuracy much faster with empirical experiments on popular DNN models later in Section
3 EXPERIMENTS
To demonstrate the effectiveness of Amata, we conduct experiments on MNIST and CIFARIO. We find that the models trained with Amata have comparable or even better performance with that of the PGD adversarial training, but with much less computational cost. For our experiment, we use PyTorch 1.0.0 and GTX1080 Ti GPU. We evaluate the adversarial trained networks against PGD and Carlini- Wagner (CW) attack (Carlini & Wagner 2017).
3. MNIST CLASSIFICATION
We consider the standard MNIST classification using the "smalICNN" architecture that was used in (Zhang al. 2019b). We set be 0.4 for Amata, In the experiment, We achieve 96% adversarial accuracy within 275 seconds while it takes PGD-40 1019 seconds to reach the same level. We also experimented with the FOSC adversarial training method in (Wang et al., (019) and found that it took FOSC 3663 seconds to achieve the same level, which confirms our previous analysis that our optimal control criterion is more suitable for accelerating adversarial training. The error-time curve is shown in Figure
(a). Then, run all methods for 57 epochs for full convergence. The robustness convergence results are shown Table 2 From Table 2 we can see that naively reducing the number of adversarial perturbations will hurt the robustness of DNNs.

---

Under review as a conference paper at ICLR 2020
6
5-
Error rate (%)
30
3-
Error
40+
2-
30
error
Amata robust error
Amata robust error
PGD-40 clean arror
PGD1O clean error
20
PGD-40 robust error
PGD10 robust enror
04
200
101)
600
800
1000
20001
4000
B0010
8000
Training time (seconds)
Training time (Seconds)
Figure Left: MNIST result. Training time against PGD-40 attack. We Amata with the setting Kmin 10 and Kmax = 40. Right: CIFARIÓ result. Training time against PGD-20 attack. We Amata with the setting Kmon = and Kmaz 10.
Table 2: MNIST adversarial training results.
Training methods
Clean accuracy
PGD-40 Attack
CW Attack
Time (Seconds)
ERM
99.52%
5.58%
0.10%
268.10
PGD-5
99.58
80.99%
0.31%
709.21
PGD-10
99.57%
93.8%
1.06%
1234.30
PGD-40
99.51%
97.02%
93,49%
4331.81
FOSC Wang et al. 2019)
99.51%
97.02%
81.79%
14928.53
Amata( K min = 5, K max
10)
99.53%
97.11% %
86.92%
2533.28
Amata K min 10, Kmar- 40)
99.45%
96.97%
94.37% %
2675.64
3.2 CIFARIO CLASSIFICATION
For the more complex CIFARIO classification task, we use the PreAct-Res-1 network (Madry et al,, 2017). We less than 55% robust error while for PGD-10, it took 6944 seconds. We also tested FOSC adversarial training and found that it took 8385 seconds reach the same level, which a bit longer than PGD- 10. The error-time curve is shown in Figure 2 (b). We further run all methods for 100 epochs for convergence. The results are shown Table
be 20/255 for Amata. The proposed Amata method took 3045 seconds achieve
Table 3: CIFAR10 PreAct-Res-I 18 adversarial training results.
Training methods
Clean accuracy
PGD-20 Attack
CW Attack
Time (Seconds)
ERM
94.75%
0.0%
0.23%
2099.58
PGD-2
90.16%
31.70%
13.36%
6913.36
PGD-10
85.27%
47.31%
51.73%
23108.10
FOSC Wang et al. 2019)
85.47%
48.04%
53.65 %
26126.98
Amata(K,.... 2. Kmns
10)
85.52%
47.62%
52.94%
14308.96
4 CONCLUSION
We have proposed a modification amounting to two lines of code to PGD adversarial training that achieves comparable or even better robustness with only 1/3 to 1/2 the computational cost over a variety of benchmarks. Moreover, a general optimal control formulation of adversarial training with hyper-parameters through numerical criterion based on the Pontryagin's maximum principle. A proof of convergence of our algorithm is also provided Appendix C As a point of future work, we will explore adap- introduced here.
developed to analyze this procedure and justify its superior performance
tive methods for adversarial training based the optimal control formulation This approach can also lead to algorithms that can be combined with YOPO or parallel adversarial training methods for maximal efficiency. An example is shown in Appendix B.3
8

---

Under review as a conference paper at ICLR 2020
REFERENCES
Naveed Akhtar and Ajmal Mian. Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey. arXiv preprint / 8805000533 2018.
Aharon Ben-Ta Tal and Arkadi Nemirovski. Robust convex optimization. Mathematics of operations research, 23(4):769-805 1998.
Dimitri P Bertsekas. Dynamic programming and optimal control, volume Athena scientific
Belmont, MA, 1995.
Dimitri P Bertsekas, Dimitri Bertsekas, Dimitri P Bertsekas, and Dimitri P Bertsekas. Dynamic programming and optimal control, volume 1. Athena scientific Belmont, MA, 1995.
Sanjit Bhat and Dimitris Tsipras. Towards Efficient Methods for Training Robust Deep Neural Networks, 2019.
Vladimir G Boltyanskii, Revaz V Gamkrelidze, and Lev Pontryagin. The theory of optimal pro- cesses. The maximum principle. Technical report, TRW Space Tochnology Labs, Los Angeles, California, 1960.
Jacob Buckman, Aurko Roy. Colin Raffel, and Ian Goodfellow. Thermometer Encoding: One Hot Way To Resist Adversarial Examples. In International Conference on Learning Representations, 2018. URL https://ppemeeeeeew///ffoommmmm -du--- 8Su--CW
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In Security and Privacy (SP), 2017 IEEE Symposium on, pp. 39-57. IEEE, 2017.
F L Chernousko and A A Lyubushin. Method of successive approximations for solution of optimal control problems. Optimal Control Applications and Methods, 3(2):101-114, 1982. ISSN 0143- 2087.
Weinan E, Jiequn Han, and Qianxiao Li. A mean-field optimal control formulation of deep learning. Research the Mathematical Sciences, 6(1):10, 2019. ISSN 2522-0144.
Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572. 2014.
Warren He, James Wei, Xinyun Chen, Nicholas Carlini, and Dawn Song. Adversarial example defenses: Ensembles of weak defenses are not strong. arXiv preprint arXiv: 2017.
J Zico Kolter and Eric Wong. Provable defenses against adversarial examples via the convex outer adversarial polytope. arXiv preprint arXiv: 171iv:77110008 1.0051, 2017.
Qianxiao Li and Shuji Hao. An Optimal Control Approach Deep Learning and Applications to Discrete- Weight Neural Networks. In Jemnifer Dy and Andreas Krause (eds.). Proceedings of the 35th International Conference on Machine Learning, volume 80 of Proceedings of Machine Learning Research, pp. 2985-2994 Stockholmsmässan, Stockholm Sweden, 2018. PMIR. URI. http://ppoeeedings..lrppssss///s
hh.
Qianxiao Li, Long Chen, Cheng Tai, and Weinan E. Maximum principle based algorithms for deep learning. The Journal of Machine Learning Research, 18(1):5998 00115999886666...811 2017. ISSN 1532-4435.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant adversarial attacks, arXiv preprint arXiv:1706.00 06083, 2017.
Dongyu Meng and Hao Chen. MagNet: A Two-Pronged Defense against Adversarial Examples. In ACM Conference on Computer and Communications Security, 2017.
Ali Shafahi, Mahyar Najibi, Amin Ghiasi, Zheng Xu, John P Dickerson, Christoph Studer, Larry Davis, Gavin Taylor, and Tom Goldstein. Adversarial Training for Free! CoRR, abs/ 2019. URL

---

Under review as a conference paper at ICLR 2020
Aman Sinha, Hongseok Namkoong, and John Duchi. Certifiable Distributional Robustness with Principled Adversarial Training. In International Conference on Learning Representations, 2018. URL http:://wpppmeee......c//oooools
Yang Song. Taesup Kim, Sebastian Nowozin, Stefano Ermon, and Nate Kushman. PixeIDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examples. In In- iernational Conference on Learning Representations, 2018. URL https://ppnneevee.ne///onnn
id=rJUYGxbCW
Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199, 2013.
Florian Tramèr, Alexey Kurakin, Nicolas Papernot, Dan Boneh, and Patrick McDaniel. Ensemble adversarial training: Attacks and defenses. arXiv preprint arXiv: 7007777550700 2017.
Yisen Wang, Xingjun Ma, James Bailey, Jinfeng Yi, Bowen Zhou, and Quanquan Gu. On the Con- vergence and Robustness of Adversarial Training. In Kamalika Chaudhuri and Ruslan Salakhut- dinov (eds.), Proceedings of the 36th International Conference on Machine Learning, volume 97 of Proceedings of Machine Learning Research, pp. 6586-6595, Long Beach, California, USA, 2019. PMLR.
Dinghuai Zhang, Tianyuan Zhang. Yiping Lu, Zhanxing Zhu, and Bin Dong. You Only Prop- agate Once: Accelerating Adversarial Training via Maximal Principle. arXiv preprint arX- iv:1905.00877, 2019a.
Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric P Xing, Laurent El Ghaoui, and Michael I Jordan. Theoretically Principled Trade-off between Robustness and Accuracy. CoRR, abs/1901 .0, 2019b. URL http://aarxivoogg/bb////1111111
A APPENDX:-ADITTINAL EXPERIMENT DETAILS
We use similar experiment settings as in (Zhang et al. 2019a).
A.1 MNIST CLASSIFICATION
In this experiment, for PGD adversarial training, we set adversarial constraint as 0.3, the step size 0.01. For CW attack results in this experiment, we set the parameter eps to be 100 and run for 100 iterations in this reference implementation htgllm/mnnaionn/tts///gbbbbb.bb blob/master/atttckkrrrwww
For display the error- time-timm curve, use the smoothing function used in Tensorboard for all methods. The smoothing parameter is set as 0.09. For outer minimization, we the stochastic gradient descent method and set the learning rate as 0.1, the momentum 0.9, and the weight decay as 5e-4.
A.2 CIFAR CLASSIFICATION
In this experiment, for PGD adversarial training, we set the adversarial constraint as 8/255, the step size 2/255. For CW attack results in this experiment, we set the parameter eps to be 0.5 and run for 100 iterations in this reference implementation happl//mentttoo/ptpps//ihhbbbb.o http://tw..ooo/uuuuung/////////e
blob/master/attecker/wwyy For display the error-time curve, we use the smoothing function used in Tensorboard for all methods. The smoothing parameter is set as 0.6. For outer minimization, we the stochastic gradient descent method and set the learning rate as 5e-2, the momentum 0.9, and the weight decay as 5e-4. We also use piece-wist wise constant learning rate scheduler Py PoTch by setting the milestones the 75-th and 90-th epoch with factor of O.1..
10

---

Under review as a conference paper at ICLR 2020
B APPENDIX:ADDITIONAL EXPERIMENT RESULTS
B.1 WIDERESNET-34 RESULTS
We experiments using WideResNet-34 networks for CIFARIO classification. We use the same periment setting as the CIFARIO classification task in the paper. We run all methods for 100 epochs for full convergence. The result is shown in Table
Table 4: CIFAR1O WidcResNet-34 adversarial training results.
Training methods
Clean accuracy
PGD-20 Attack
CW Attack
Time (Seconds)
PGD-10
85.80%
45.38%
30.82%
150653.44
Amata min 2, Kmar 10)
85.77%
30.42%
52.94%
90945.15
B.2 ADDITIONAL MNIST RESULTS
We further plot the MNIST results Figure 2 but with the x-axis denoting the number of training epochs. The results are shown in Figure From this figure, we can see that the time-saving of our method is mainly due to the savings in the adversarial examples generation step. This is expected if we achieve faster convergence rates with regard to the number of epochs, it may indicate that the adversarial examples generated by the proposed mechanism is significantly weaker and the outer minimization step converges faster.
att (8)
3-
Amata dlean
Amata robust
1-
PGD 44 clean crror
PGD-40 robust ernor
0-
50
Training Epoch
Figure 3: MNIST result. Training epoch against PGD-40 attack. We use Amata with the setting Kmin 10 and Kmar = 40.
B.3 YMA
To demonstrate that our method can be incorporated in other acceleration method to further improve performance, we implement the Amata in YOPO MNIST classification experimen For Amata incorporation, we gradually increase the K and decrease a in the codes that is similar to the case of modifying the PGD algorithm. We rum Amata+YOPe and YOPO for 40 epochs as in the original setting. The results are shown in Figure From Figure we
that Amata+ YOPO takes 294 seconds to reach the adversarial accuracy of 94%, which is only around half of the time for YOPO to achieve the same adversarial accuracy. is also worth noting that Amata+ even better adversarial accuracy when converged. From this example, we can see that Amata can be seamlessly incorporated in other adversarial training acceleration algorithm provide further acceleration.
Amata+YOPO YOPO achieves
5-10
11

---

Under review as a conference paper at ICLR 2020
14
raze (%)
6-
YOPO clean
Amata=YOPO robust
2-
YOPO clean
YOPO robust ererr
0-
200
400
600
800
1000
1200
Training time (scconds)
Figure 4: MNIST result. Training epoch against PGD-40 attack. We use Amata with the setting Kmin 2 and Kaaz 5.
B.4 EVALUATION AGAINST DIFFERENT SETTINGS PGD
The reason choose PGD-40 for evaluation is that is strong adversarial attack that is also used in other papers (Zhang et al. 2019a). We also try other settings, such as PGD-20 and PGD-60. Other settings are the same are shown in Figure 5 We can see that compared with the case of PGD-40 for evaluation, both Amata and PGD-40 are able achieve above the 96% adversarial accuracy but at different speeds. In the case of PGD-20, Amata takes around 28% training time of the PGD-40 to achieve the 96% adversarial accuracy. In the case of PGD-60, Amata takes around 60% training time of the PGD-40 to achieve the 96% adversarial accuracy.
original settings in MNIST classification experiment. The results
Error
Enar
Amata clean error
Amata clean enror
Amata rebust error
Amata robust error
PGD-40 clean arnor...
PGD-40 clcan error
PGD-40 rebust enror
PGD-40 robust error
200
400
800
1000
1500
2500
3000
3300 4000
Training time (seconds)
Training time (seconds)
Figure 5: Left: MNIST result. Training epoch against PGD-20 attack. Right: MNIST result. Training epoch
against PGD-60 attack.
B.5 OTHER DECAY SCHEME FOR CONTROLLING ADVERSARIAL TRAINING
Finding better decay scheme an interesting future direction. However, using more complex schemes may introduce extra parameters, while one of the major challenges for machine learn- ing methods to be practically useful for industry practitioners is the complexity the method. We tried another exponential scheme:
K = Kmi + (Kman - Kmin) (1 exp 1expp=-)/( 9/
exp
(17)
where K, is the number of PGD adversarial training steps t-th epoch, Kmin is the minimum number of PGD steps the beginning. Kmar is the maximum number of PGD steps the last epoch, yj is the hyper-parameter controlling the shape of the scheme. This design ensures that when
12

---

Under review as a conference paper at ICLR 2020
Kg Kinn and Kr Kee make the exponential decay scheme comparable with the linear scheme used in our paper. However, we tried different parameters of eta ranging from 0.1 to 5, but did not performance improvements. The results shown in Figure 6 The "Amata (Exp eta)" in the legend denotes the exponential decay scheme and the "Amata" in the legend denotes the original linear decay scheme. From Figure outperform the linear decay scheme.
see that the the exponential decay scheme cannot
rate (%)
6-
Amata robust error
Amata(Exp eta, 0.1) mbuust arroe
Amata EExp eta 0.2) robust error
Amata Exp eta 1] robust enror
2-
Amata! Exp eta 2) robust
Amata( 5) robust
200
4001
600
800
1000
Training (seconds)
Figure MNIST result. Training epoch against PGD-40 attack. We use Amata with the setting Kmin and mar 5.
C PROON OF CONVERGENCE
We provide convergence analysis of proposed Amata algorithm for solving the min-max prob-
lem. The proof of convergence this paper largely follows (Wang et al., 2019 Sinha et al. 2018).
First, we will introduce some notations first for clarity. We denote x x²( arg max ex f0, x,)
where /0, x:) a short hand notation for the classification loss function, X {x] | x S Sc),
and (.) = maxx,ex: f(0, x.). then (0) is a 8-approximate solution by our algorithm to x; (0), if it satisfies that:
X (0) xx( 5
(18)
In addition, denote the objective function in Equation bb (s( and its gradient by (L) = Ei= (f)) Let g
ΣieB (ef(0) be the stochastic gradient of Ls(0), where B is the
mini-batch. Then, we have E g DiEB Vof (0) be the approximate stochastic gradient of (0). Before we prove the convergence of the algorithm, we have following assumptions.
(O). Let Vof(0, x()) be the gradient of f(0, x())
with respect to 0, and g(0)
Assumption 1. The function f(0,x) satisfies the gradient Lipschitz conditions:
supx Vo. x) Vof(0", x))1, S Loo ||@ Il2 2 < Løx xx
0" ||
supa (ef((0xx) (e x*) supx x0, Vx,(0", x*) Lxo | 0"
x" l|2
where Loo. Lox, and Lxe are positive constants. Wang et al. 2019).
Assumption was used in (Sinha et al.
2018
Assumption 2. The function f(0,x, x) is locally p-strongly concave in X' = {x for all i [n], i.e., for any X1 Xx:
||x x
<e)
1 x1) < f(0, x2) (Vx/ x2), X2) ||x|
x2
where f is a positive constant which measures the curvature of the loss function. This assumption was used for analyzing distributional robust optimization problems (Sinha et al. 2018).
13

---

Under review as a conference paper at ICLR 2020
Assumption 3. The variance of the stochastic gradient g(0) is bounded by constant o² > 0:
Blllg(0) L o²
where (l) is the full gradient.
The Assumption 3 commonly used for analyzing stochastic gradient optimization algorithms.
Theorem 2. Suppose Assumptions
2 and holds. Denote A Ls(00) ming Ls If the
step size of outer minimization T min(1 I, v Tio:) Then, we have:
LA
Σ
VLs (0) 40 4
+ 52
T
T
where L Lgx Lee-
The proof of this theorem can be found in the Appendix. Theorem inndiattes that if the Amata finds solutions of the inner maximization problem closer enough to the maxima, Amata can converge at sublinear rate.
Lemma 1. Under Assumption and Assumption
have (s( is L-smooth where L
Løx Lxx/ p + Leo, i.e., for any O1 and O2 it holds:
L -/ 110 -0211
Ls(01) S Ls (VL)(02), 0, 02)
2
The proof of Lemma] 1 can be found in Wang et al. 2019
Lemma 2. Under Assumption ] and Assumption 2 the norm of difference between the approximate stochastic gradient g(0) and the stochastic gradient g()) is bounded, i.e., it holds that:
(lā(0) - 9(0) 2 S Loxo
Proof. We have
1 (ef(0.2((0) v.((O))
()((0)
g
B
iEB
(0, vef(0.x;(0))
13
iEB
Lox (0) (0)
(19)
B
IEB
where the first inequality is from the triangle inequality, and the second inequality is from Assump- Next, we insert Equation 18 into the above inequality then:
tion I
(lā(0) 9(0) - Lexd
(20)
which completes the proof.
Now can prove the Theorem 2
14

---

Under review as a conference paper at ICLR 2020
Proof. From Lemma have:
I | - -01
(s( S Ls(0') (VLs(0'' 0t+1 -0) + 2
= =s(00' + Th < VLs(0- - -0(0') mh L (0'))12
Lid |
Laft
Lint
(s()') - ni(1 2 V L (0) [|2 -7
2
(L)s(0') VLs(0') 0(0))) + T.
|[Ā(0)) VL3 (0'(10)
2
-0s m6(1 LTj V L. (.T.s(00))) 7c
Lm
2
LT
(V)s(0'), VLs(0') ()0)) + m
)( (V'))
2
VLs(0') ((0 + Lu
2 |0((0') -0(0') + 9(00) - vLs(00)12
Ls(0') The (1
LTk
(0)) + no LTn
2 2
(Ā( - 0( + Ln ( ((0)) )|2 + +199(0))
Li (VLs( (Ls -
VLs(0') + (1+
2
Note that [ (l), taking expectation on both sides of the inequality conditioned on 0
Then we use Assumption and Lemma 2 and simplify the above inequality:
[l -ls(0'))0
T/ The (1
Lnn [|VLs(0*)|1
2
11 (1 3Ime 12x00 6² LnĀo²
2
Taking the telescope sum of the above equation from (= 0 1 T have
1
Σ
Th
(1
I Th
E
(Ls
(00 0²))
2
t=
T-1
+
1/1 (1
+
3Lm
12 82 + Ini00
2
2
t=0
We set 7) = min(1/L, v Tf.02 ) have
LA $40 4o T
B VL)(
+ 5L
t=0
Thus, we complete the proof.
D APPENDIX: A APPROXIMATION OF THE OPTIMAL CONTROL CRITERION
In this section we show how to derive the approximation [4 from (3).. The primary assumption we make is that T2 Ti r7 < 1, which allows to use local approximation for various functions to derive a simple-to-cen to-comutt criterion. For this reason, the derivation here will be largely heuristic.
First, assume that we consider a constant control u, on the interval (Ti [t, t n/]- Next, recall that the adversarial robustness which serves as our terminal loss function for the control problem is (()) max, {(ho A y). In practice, any control that sufficiently conducts the
15

---

Under review as a conference paper at ICLR 2020
adversarial perturbation serves good approximation. This is because the DNNs are very prone to adversarial attacks before the convergence adversarial training and the real-time adversarial loss close to the worst-case adversarial loss. Thus, we approximate ((0) by L(ha A (z)), y) by some chosen z that makes practical computations easy.
Now, Assuming regularity we expand the state equation (10 to get to leading order 1) 0
0 0, + (
E (1,++))
(21)
On the other hand, the co-state equation
gives
D Vo + o(1 - - Vot(he (o + o(1), 8 (1,4+t 7/.
(22)
But, by definition F(0,u) Vol(ho(Ao. v). Then, for any [t],+ we have from (21)
and 22 that
H P.,, HOO,,p",, = (p", v)) R(vv) (Vo((ho, [A., a (z)), v), Vol(ho, [Ao, (x)), R(() o(1)
(23)
Note that the point of which the various expressions the above are expanded from appears arbitrarily chosen from strict mathematical sense, but these choices enable fast practical computation. Any of such expansions, assuming enough regularity, are equivalent in the limit 0.
Plugging the above into the expression for C (Eq. 13
we have
C(u, t) max (Ao v). Vol(ho, Tollho,,Ae..ae ( R(v))
(24)
((Vot(ho, [Ao, (x)) v), Vol(ho, (=), v)) R(u))
As discussed in the beginning of this section, to ease computation, we may replace by v in the first term and u in the second term, assuming that they give sufficient adversarial perturbations to get
Cuu, t) = max olho, (=)) x) R(v))
(25)
- <llVol (z)) y)
R(u)).
Upon substituting (K, a:) and (K*,at) gives the desired result.
16


Reviews:
[{"review_id": "S1ebs9cc5H", "reviewer": "AnonReviewer1", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "The submission follows a recent line of work that formulates adversarial training (https://arxiv.org/abs/1412.6572) as a differentiable game and attempts to reduce the computational complexity of solving the inner maximization, corresponding to finding (an) adversarial example(s) for a given parameter setting. The authors propose a way to anneal the truncation of the inner iteration, and investigate a quantity to represent the suboptimality of the truncation.\n\nStrengths:\n- (From Table 3), the method is competitive with adversarial training (PGD; Madry et al. (2017)) as well as an improved method for adversarial robustness (FOSC; Wang et al. (2019)), while requiring half the computation time.\n- The writing is very clear.\n\nWeaknesses:\n- Significance: The technique AMATA itself, is a  heuristic to gradually increase the length of the inner loop optimization in adversarial training. It is unrelated to the optimal control formulation.\n- Novelty: Much of the motivation from the perspective of an optimal control formulation of adversarial training is similar to https://arxiv.org/abs/1803.01299, including the PMP and successive approximation components; Eq. (13) of the submission is the continuous version of Theorem 2 in this paper.\n- Some experimental details are missing.\n- Minor clarity issues (see below).\n\nQuestions for the authors:\n- Could the authors better contrast their work in reference to prior work (https://arxiv.org/abs/1803.01299)? \n- Could the authors clarify if they use random restarts for the PGD attacks? How was the number of iterations for the PGD attack (40) selected? Why was the iteration count of the PGD attack not varied?\n\nClarity issues:\n- Please provide references for the optimal control formulation in 2.2.\n- Some references to variables in the text are not made precise by identifying the variable in question (e.g.: \"a set of optimal parameter choices\"; \"requires information on the entire training interval\").\n- The function of the hyperparameters \\alpha, \\gamma, K are not well discussed in Section 2.4.\n- Reduce plot sizes and include more experimental details in the main text.", "extra_scores": {"experience_assessment": "I have read many papers in this area.", "review_assessment:_checking_correctness_of_derivations_and_theory": "I assessed the sensibility of the derivations and theory.", "review_assessment:_checking_correctness_of_experiments": "I assessed the sensibility of the experiments.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper thoroughly."}, "extra_text": {}}, {"review_id": "BylzHYg15H", "reviewer": "AnonReviewer2", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "Summary: Deep learning algorithms are known to be prone to adversarial examples. This paper proposes a simple modification for adversarial training in order to improve the robustness of the algorithms. The adversarial training of the neural networks involve two steps: the outer loop where the loss is being minimized, the inner loop where the adversarial examples are being found by using PGD. The inner PGD optimization makes training more expensive, because for every gradient step, algorithm needs to perform several steps of PGD. This paper proposes a simple modification to the PGD that is being used in the inner loop. The proposed modification involves the increasing the number of adversarial training steps and decreasing the adversarial training step size gradually as the training proceeds. Then, they analyze the modifications from the theory of optimal control. Their experiments show that their method can achieve similar robustness to the other existing approaches with less computations.\n\nPros: \n - Interesting topic, important subject and a very simple approach.\n - Significant improvements in terms of training times.\n\nCons: \n- The math notation is a bit cumbersome, lots of undefined variables and functions used without properly giving enough background to the readers. This field is still new not every reader might be familiar with the optimal control theory or the common notation that is being used there. Please try to explain the equations and theorems more carefully.\n- Experiments are only on small-scale toy-datasets like CIFAR10 and MNIST.\n\nComplete Assessment: I like the proposed approach, in this paper. It is a fairly simple approach and seems to work well in practice, at least on the tasks that the authors have tried. The writing, I think still needs some work, some of the math notation is mostly not properly explained, in Sections 2.2 and 2.3. Overall, I am not sure how much those two sections are actually contributing to the paper.\n\nQuestion: Did you try using a different annealing mechanisms, besides linear decaying, such as an exponential one?", "extra_scores": {"experience_assessment": "I have read many papers in this area.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper at least twice and used my best judgement in assessing the paper.", "review_assessment:_checking_correctness_of_experiments": "I assessed the sensibility of the experiments.", "review_assessment:_checking_correctness_of_derivations_and_theory": "I assessed the sensibility of the derivations and theory."}, "extra_text": {}}, {"review_id": "BJgaBtsAKH", "reviewer": "AnonReviewer3", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This paper proposed an annealing mechanism for PGD adversarial training in Madry et al. This mechanism gradually reduces the step size and increases the number of iterations of PGD maximization. The authors claim that the proposed method can achieve comparable performance as the original PGD adversarial training with less time. \n\nFirst I think this mechanism itself's contribution is kind of incremental because this technique is well under the PGD adversarial training framework. In fact, there are existing works trying to accelerate adversarial training, for example [1]. I think the authors may need to compare their proposed method with [1] if possible.\n\nI like the optimal control formulation in 2.2 and 2.3. More discussion on (8) would be welcomed. In particularly, I think the authors implicitly define the training cost as the sum of iterations in all PGD attacks and turn it into an integral. More explanation here would help. Also, it seems that the reason why \\alpha=\\frac{\\tau}{K^t} is not fully explained in the paper. The authors choose to fix the total step length of PGD. Is this a heuristics?\n\nIn the experimental part, I think it would be better to also report the number of SGD steps on \\theta to get a sense of convergence. I am not sure the acceleration is due to fewer PGD steps at each t, or fewer training epoch T. \n\n[1] Zhang, Dinghuai, et al. \"You Only Propagate Once: Accelerating Adversarial Training via Maximal Principle.\" NeurIPS 2019.", "extra_scores": {"experience_assessment": "I have published one or two papers in this area.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper at least twice and used my best judgement in assessing the paper.", "review_assessment:_checking_correctness_of_experiments": "I assessed the sensibility of the experiments.", "review_assessment:_checking_correctness_of_derivations_and_theory": "I assessed the sensibility of the derivations and theory."}, "extra_text": {}}]

Author rebuttal:

Meta-review: The paper proposes a modification for adversarial training in order to improve the robustness of the algorithm by developing an annealing mechanism for PGD adversarial training. This mechanism gradually reduces the step size and increases the number of iterations of PGD maximization. One reviewer found the paper to be clear and competitive with existing work, but raised concerns of novelty and significance. Another reviewer noted the significant improvements in training times but had concerns about small scale datasets. The final reviewer liked the optimal control formulation, and requested further details. The authors provided detailed answers and responses to the reviews, although some of these concerns remain. The paper has improved over the course of the review, but due to a large number of stronger papers, was not accepted at this time.
Decision: Reject