Efficient Robust Training via Backward Smoothing
Authors: Jinghui Chen
Yu Cheng
Zhe Gan
Quanquan Gu
Jingjing Liu
Venue:  (2021)
Keywords: Efficient Robust Training
Backward Smoothing
Robustness

Abstract: Adversarial training is so far the most effective strategy in defending against adversarial examples. However, it suffers from high computational cost due to the iterative adversarial attacks in each training step. Recent studies show that it is possible to achieve Fast Adversarial Training by performing a single-step attack with random initialization. Yet, it remains a mystery why random initialization helps. Besides, such an approach still lags behind state-of-the-art adversarial training algorithms on both stability and model robustness. In this work, we develop a new understanding towards Fast Adversarial Training, by viewing random initialization as performing randomized smoothing for better optimization of the inner maximization problem. From this perspective, we show that the smoothing effect by random initialization is not sufficient under the adversarial perturbation constraint. A new initialization strategy, \emph{backward smoothing}, is proposed to address this issue and significantly improves both stability and model robustness over single-step robust training methods. Experiments on multiple benchmarks demonstrate that our method achieves similar model robustness as the original TRADES method, while using much less training time (~3x improvement with the same training schedule). 

Under review as a conference paper at ICLR 2021
EFFICIENT ROBUST TRAINING VIA BACKWARD SMOOTHING
Anonymous authors Paper under double-blind review
ABSTRACT
Adversarial training is so far the most effective strategy defending against ad- versarial examples. However, it suffers from high computational cost due to the iterative adversarial attacks in each training step. Recent studies show that it is possible to achieve Fast Adversarial Training by performing single-step attack with random initialization. Yet, it remains a mystery why random initialization helps. Besides, such an approach still lags behind state-of-the-ar adversarial train- ing algorithms on both stability and model robustness. In this work, we develop a new understanding towards Fast Adversarial Training, by viewing random initial- ization as performing randomized smoothing for better optimization of the inner maximization problem. From this perspective, we show that the smoothing ef- feet by random initialization is not sufficient under the adversarial perturbation constraint. A new initialization strategy, buckward smoothing, proposed ad- dress this issue and significantly improves both stability and model robustness over single-step robust training methods. Experiments on multiple benchmarks demonstrate that our method achieves similar model robustness as the original TRADES method, while using much less training time (~33x improvement with the same training schedule).
INTRODUCTION
Deep neural networks are well known to be vulnerable to adversarial examples (Szegedy et al,, 2013), i.e., a small perturbation on the original input can lead misclassification or erroncous prediction. Many defense methods have been developed to mitigate the disturbance of adversarial examples Guo et al., 2018 Xie et al. 2018: Song et al. 2018 Ma al. 2018 Samangouei al. 2018 Dhillon et al. 2018 Madry et al. 2018 Zhang et al.) 2019). among which robust training methods, such as adversaril training (Madry et al.) 2018) and TRADES (Zhang et al., 2019), are currently the most effective strategies. Specifically, adversarial training method (Madry et al. 2018) trains a model on adversarial examples by solving min-max optimization problem:
min = Σ max I((o(x)).))) 7I (x.)
1
(1.1)
where {(x;,,)) is the training dataset, f(-) denotes the logits output of the neural network, (x;)) = {x: | x2 <e} denotes the e-perturbation ball, and L is the cross-entropy loss.
the other hand, instead directly training on adversarial examples, TRADES (Zhang et al. 2019) further improves model robustness with trade-off between natural accuracy and robust curacy, by solving the empirical risk minimization problem with a robust regularization term:
min Σ [(fo(())) + B max KL (ss((f(x))) (x.).(x))
(1.2)
where s(.) denotes the softmax function, and B > is a regularization parameter. The goal of this robust regularization term (i.e., KL divergence term) is to ensure the outputs stable within the local neighborhood. Both adversarial training and TRADES achieve good model robustness, shown on recent model robustness leaderboards" CCrce Hein 2020b Chen & Gu 2020
httpss///gtthub.com//fta
attack and https::/ggtthb.....tt
am1 /Rays

---

Under review as a conference paper at ICLR 2021
However, major drawback lies in that both are highly time-consuming for training, limiting their usefulness in practice. This is largely due to the fact that both methods perform iterative adversarial attacks (i.., Projected Gradient Descent) to solve the inner maximization problem in each outer minimization step.
Recently, Wong et al. 2020) shows that it is possible use single-step adversarial attacks solve the inner maximization problem, which previously was believed impossible. The key ingredient in their approach is adding random initialization step before the single-step adversarial attack. This simple change leads to a reasonably robust model that outperforms other fast robust training techniques, e.g., [Shafahi et al. (2019). However, it remains a mystery why random initialization is empirically effective. Furthermore. compared to state-of-the-ar robust training models (Madry et al. 2018 Zhang et al. 2019), this approach still lags behind on model robustness.
In this work, we aim to understand the role of random initialization, as well as closing the robustness gap between adversarial training and Fast Adversarial Training (Fast AT) (Wong al. (020). We propose a new principle towards understanding Fast AT - that random initialization can be viewed as performing randomized smoothing for better optimization of the inner maximization problem. We demonstrate that the smoothing effect by random initialization is not sufficient under the adversarial perturbation constraint. By proposing a new initialization strategy, backward smoothing, which strengthens the smoothing effect within the e-perturbation ball, we present new fast robust training method based on TRADES (Zhang et al.) 2019). The resulting method significantly improves both stability and model robustness consuming much less training time (~~ 3x improvement with the same training schedule).
the single-step version of TRADES (Zhang et al., 2019), while
2 RELATED WORK
There exists a large body of work on adversarial attacks and defenses. In this section, we only review the most relevant work to ours.
Adversarial Attack The concept of adversarial examples was first proposed in Szegedy et al. (2013). Since then, many methods have been proposed, such as Fast Gradient Sign Method (FGSM)
Goodfellow et al. 2015). and Projected Gradient Descent (PGD) (Kurakin et al.
2016
Madry
al. 2018). Later on, various attacks (Papernot al. 2016 Moosavi-Dezfooli al.
2016 Carlini
& Wagner 2017 Athalye et al. 2018 Chen et al.) 2020 Croce & Hein (220a)) were also proposed
for better effectiveness or efficieccy. There are also many attacks focused on differentt attack settings.
Chen et al. (0017) proposed black-box attack where the gradient is not available, by estimating the
O' O'Reilly 2020) Moon et a 2019 Andriushchenko et al., 2019: TTshiro et al. (2200) have been developed to im-
gradient via fiftee-differences. Various methods (Ilyas et al. 2018 AI-Dujaili
prove the query efficiency of Chen et al. (2017). Other methods (Brendel et al. 2018 Cheng et al.) 2019 2020) focused on the more challenging hard-label attack setting, where only the prediction la- bels are available. On the other hand, there is recent work (Croce & Hein [020b] Chen & Gu 2020)
that aims to accurately evaluate the model robustness via ensemble of attacks effective hard label
attack.
Robust Training Many heuristic defenses (Guo al. 2018: Xie al. 2018 Song et al. 2018
Ma et af. 22018) Samangouei et al., 2018 Dhillon et al., 2018) were proposed when the concept of
adversarial examples was first introduced. However, they are later shown by [Athalye al. (2018) as not truly robust. Adversarial training (Madry et al. 2018) is the first effective method towards defending against adversarial examples. In Wang et al. (211)) a new convergence quality criterion was proposed. Zhang et al. (2019) showed the trade-off off between natural accuracy and robust ac- curacy. Wang al. (2020) proposed to improve model robustness by better utilizing misclassified examples. Another line of research utilizes extra information (e.g., pre-trained models (Hendrycks)
al. 2019) or extra unlabeled data (Carmon et al.) 2019)] Alayrac et al., 2019) to further improve robustness. Other work focuses improving training efficiency, such as free adversarial training from Shafahi et al. (2019) and Fast AT from Wong et al. (2020) using single-step attack (FGSM) with random initialization. Li al. (2020) proposed hybrid approach for improving Fast AT which is orthogonal to ours. (Andriushchenko & Flammarion (2020) proposed a new regularizer promoting gradient alignment. Yet, it is not focused on closing the robustness gap with state-of-the-arts
Randomized Smoothing Duchi et al. (012)) proposed the randomized smoothing technique and proved variance- based convergence rates for non-smooth optimization. Later on, this technique was
2

---

Under review as a conference paper at ICLR 2021
applied to certified adversarial defenses (Cohen al. 2019 Salman al. 2019) for building robust models with certified robustness guarantees. In this paper, we are not targeting certified defenses. Instead, we use the randomized smoothing concept in optimization explain Fast AT.
3 WHY RANDOM INITIALIZATION HELPS?
We aim to explain why random initialization in Fast AT is effective, and propose new under- standing that random initialization can be viewed as performing randomized smoothing on the inner maximization problem in adversarial training (Madry et al. (018). Below, we first introduce the randomized smoothing technique (Duchi et al. 2012) in optimization.
well known from optimization theory (Boyd al. 2004) that non-smooth objectives are gen- erally harder to optimize compared with smooth objectives. In general, a smoother loss function allows us use larger step size while guaranteeing the convergence of gradient-based algorithms. Randomized smoothing technique (Duchi et al. 2012) was proposed based on the observation that random perturbation of the optimization variable can be used to transform the loss into a smoother one. Instead of using only the gradient at the original iterate, randomized smoothing proposes to ran- domly generate perturbed iterates and use their gradients for optimization procedure. More details provided in Appendix A Let recall the inner maximization problem in adversarial training:
max L(fo(x + v).
(3.1)
6E
Here, fo denotes a neural network parameterized by 0. In general. neural networks are non-smooth due to ReLU activations and pooling layers. This suggests that (3.1) can be difficult to solve, and using gradient descent with large step size can lead to divergence in the maximization problem. also explains why directly using single-step projected gradient ascent without random initialization fails (Wong et al. 2020). Now, let us apply randomized smoothing to (3.1 I
max Be-u((-1a)L(fo(x + v)), 6EB.(0)
(3.2)
where & is the perturbation vector for randomized smoothing. and ö is the perturbation vector for later gradient update step (initializedd as zero). Suppose we solve (3.2) in a stochastic fashion (i.e., sample a random perturbation & instead of computing the expectation over Z), and using only one step gradient update. We can see that this reduces to the Fast AT formulation. This suggests that Fast AT can be viewed as performing stochastic single-step attacks on a randomized smoothed objective function which allows using larger step size. This explains why random initialization helps Fast AT as it makes the loss objective smoother and thus easier to optimize.
It is worth noting that Andriushchenko & Flammarion (2020) also provided an explanation of why Fast Adversarial Training works: random initialization reduces the magnitude of the perturbation and thus the network becomes more linear and fits better toward single-step attack. While argue that the random initialization works as randomized smoothing for smoothing the inner maximization problem and makes it easier solve. In fact, argument is because if the loss function is approximately linear, then it will be very smooth, i.e., the second-order term in the Taylor expansion is very small.
general and can cover theirs,
4 PROPOSED APPROACH
4.1 DRAWBACKS OF THE RANDOM INITIALIZATION STRATEGY
Although Fast AT achieves much faster robust training compared with standard adversarial training Madry et al. 2018). it exposes several major weaknesses. For demonstration, we exclude the ad- ditional acceleration techniques introduced in Wong al.) (2020) for accelerating the training speed (e.g., nix-precision training, cyclic learning rate), and instead apply standard piecewise learning rate decay used in Madry et al. (2018) ; Zhang et al. 2019) with the decay point set at the 50-th and 75-th epochs.
Performance Stability As observed in Li et al. 2020). Fast AT can be highly unstable (i.e., large variance in robust performance) when using traditional piecewise learning rate decay schedule. We argue that this is because Wong et al. (2020) utilized a drastically large attack step size (10/255, even larger than the perturbation limit e), which causes unstable training behavior.
3

---

Under review as a conference paper at ICLR 2021
Table 1: Model robustness comparison among Fast Adversarial Training, Adversarial Train- ing, and TRADES, using ResNet-18 model on CIFAR-10 10 dataset.
46
Robust Accuracy (%6
433
13.05
Method
Nat (%)
Rob (%)
22
Fast AT (avg. over 10 runs)
84.58
44.52
Median
Fast AT (best over 10 runs) AT (early-stop) TRADES
84.79
46.30
10.50
Mean
82.36
51.14
step size-10/255 step =00--255
step size-7/255
Fast AT
82.33
52.74
Figure 1:
Comparison of Fast Adversarial Training performance with different step sizes.
To validate this, we run Fast AT on CIFAR-10 using ResNet-18 model (He et al. 2016) for 10 times with different step sizes. Note that we adopt early-stopping and record the best-performing model among 100 epochs. As shown in Figure although the single-best robustness performance is obtained by using step size 10/28 10/255, the variance is very high. Moreover, most trials lead to weak robust performance with low average and median robust accuracy. On the other hand, we observe that when using step size 8/255, model robustness is more stable and higher on average. Note that using a too small step size would by nature hurt model robustness. These observations suggest that Fast AT cannot achieve the best performance robust performance and stability simultaneously.
Potential for Robustness Improvement Fast uses standard adversarial training (Madry et al., 2018) the baseline, and can obtain similar robustness performance. However, later work (Rice ct al. 2020) shows that adversarial training can cause the overfitting problem, while early stopping largely improve robustness. Zhang al. (2019) further achieves
better model robustness
that is much higher than what Fast AT obtains. From Table [] we observe that there exists an 8% robust accuracy gap between Fast AT (average over 10 runs) and the best-performing TRADES model. Even for the best out of 10 trials, there is still a 6% gap. This indicates that Fast AT is still far from optimal, and there is still big room for further robustness improvement.
4.2 A NAIVE TRY: RANDOMIZED SMOOTHING FOR TRADES
As shown in Table I TRADES enjoys better model robustness compared with standard adversarial training. A naive attempt is to apply randomized smoothing to TRADES and see this leads to better robustness than Fast AT. Let recall the inner maximization formulation for TRADES:
max KL (L((so(()) 8E),(0)
(4.1)
Similarly, we can smooth this objective and solve the following objective instead:
max BEB_ (0)
<(J((x + +()).
(4.2)
This leads to the same adversarial example formulation as using random initialization and then performing single-step projected gradient ascent. We refer this strategy Fast TRADES.
Hessian Maximum Eigenvalue
46.42
1.75
Orignal Examples
Robust Accuracy (%)
Examples Backward Smoothed Examples
1.50
1.00
43.30
43.37
0.75
43
0.50
Median
*2
Mcan
step size=8/255
step size=6/255 step size=5/255
Fast TRADES
Epochs
Figure 2: Comparison of Fast TRADES perfor- mance under different step sizes.
Figure 3: Hessian maximum eigenvalue com- parison against training epochs.
We experiment with Fast TRADES using different step sizes, and find that its performance is sen- sitive step size, similar to Fast AT. As shown in Figure 2 using large step size of 8/255 leads
4

---

Under review as a conference paper at ICLR 2021
to very low average and median robust accuracy. We notice that reducing the step size to 6/255 yields better average robust accuracy, which is also slightly higher than Fast AT. Nevertheless, the improvements here over Fast AT are not significant. This inspires to study how design better strategy for more significant improvements.
Recall the results from Section 4.1 Applying overly-large step size in Fast AT and Fast TRADES can lead to unstable training with deteriorated robustness. This suggests that the randomized smooth- ing effect might not be strong enough (i.e., the objective function not smooth enough) enable the use of larger step size. However, unlike the general randomized smoothing setting, one of the special constraints in the adversarial setting that random perturbation the input vector subject to the e- ball constraint, therefore cannot be too large. This means that we cannot further increase the smoothing effect by simply using larger random perturbations.
To further validate the claim that the random smoothing effect is not sufficient, we carefully study the loss smoothness under different smoothing techniques. Figure [3] shows the maximum eigenvalue of Hessian of the loss function the original examples, randomly perturbed examples, and backward smoothed examples along the training trajectory until Fast TRADES obtains its best robustness (the 5 1st epoch). We observe that during the model training process, the randomly perturbed examples have overall smaller Hessian maximum eigenvalud than that of original examples. This suggests that random smoothing indeed makes the loss function smoother. Moreover, the Hessian maximum eigenvalue under backward smoothing is much smaller than that under random smoothing, showing the insufficiency of the random smoothing techniques and the advantages of our proposed backward smoothing method.
4.3 BACKWARD SMOOTHING
Now introduce proposed method to ad- dress the above issue. The goal to fur- ther boost the smoothing effect of randomized smoothing without violating the c-perturbation constraint. Note that if are allowed use larger random perturbations, we expect that (L(s(fo(x)) s())) sffo(x + u)))) will also be larger, meaning that the neural network output of the random initialization fo(x + uE) should be more different from the original output fo(x) (as shown in Figure 4.. This inspires us to gener- ate the initialization point in backward fash- ion. Specifically, let us denote the input domain Rd as the input space, and their correspond- ing neural network output fo E I as the out- put space, where is the number of classes for the classifier. We first generate random points in the output space just as randomized smoothing does in the input space, i.e., fx(x) rxb, where sb U--1,1) 1) is the random variable and small number. Then we find the corresponding
Input
Space
Smoothing
Stronger Randomized Smoothing
Backward Smoothing
whh perturbation Input/outpui +/+ computed perturbation inpusbourput space
Figure 4: A sketch of our proposed method. input perturbation backward fashion and use as our initialization. An illustrative sketch of our proposed method is provided in Figure 4
Now we formalize our proposed method mathematical language. The key step in our proposed method is to find the input perturbation such that:
fo(x + {) = fo(x) + 7sb.
(4.3)
In order to find the best ex to satisfy
4.3
we turn solve the following problem:
<* argmin KL KL (f6 ())(
(4.4)
$E8, (0)
"hhe smaller Hessian maximum eigenvalue, the smoother the loss function is.
5

---

Under review as a conference paper at ICLR 2021
Note that & is initialized as a vector. For the sake of computational efficiency, solve 4.4) using single-step PGD in practice. Then, similar to Wong et al. (2020), we use single-step gradient update for the inner maximization problem:
8
argmax (L((s(f(x)), (0)
+))))).
(4.5)
Finally, we update the neural network parameter 0 using stochastic gradients at the adversarial point + E" + 8" summary our proposed algorithm is provided in Algorithm [ Note that the proposed Backward Smoothing seems also compatible with Adversarial Training. However, Adver- sarial Training does not contain terms using KI. divergence loss, which may hinder its performance. We will show this empirically in Section 5
Algorithm Backward Smoothing
1: input: The number of training iterations T, number of adversarial perturbation steps K, maxi- mum perturbation strength e, training step size 77, adversarial perturbation step size a, regular- ization parameter 3 > O;
2: Random initialize model parameter 0g
3: for t = 1,..., do
4: Sample mini-batch fx, 9t 1= from training set
5: Obtain &* by solving (4.4)
6: Obtain d" by solving
7: 0, 0,-1 n/m-
V
()) + ( + +
+)))
8: end for
We notice that Tashiro et al. (2200) proposed an attack which also samples diversified points in the output space. Yet their method not focused on randomized smoothing and has totally different formulation, and they are generating diversified output points for better attack efficiency rather than achieving better defense.
EXPERIMENTS
In this section, we empirically evaluate the performance of our proposed method. We first compare proposed method with other robust training baselines on CIFAR-10, CIFAR100 (Krizhevsky et al. 2009) and Tiny ImageNet (Deng et al. 2009 datasets. We also provide multiple ablation studies well robustness evaluation with state-of-the-art adversarial attack methods to validate that our proposed method provides effective robustness improvement.
5.1 EXPERIMENTAL SETTING
Following previous work on robust training (aadr et al. 2018 Zhang et al., 2019 Wong et al, 2020),
0.031 for all three datasets. In terms of model architecture, adopt standard Re model (He et al. 2016) for both CIFAR-10 and CIFAR-100 datasets, and ResNet-50 model for Tiny ImageNet. We follow the standard piecewise learning rate decay schedule as used in Madry et al. (2018): Zhang et al. (2019) and set decaying point at 50-th and 75-th epochs. The starting learning rate for all methods are to 0.1. the same as previous work (Madry et al. 2018] Zhang et al. 2019). For all methods, we tune the models for their best robustness performances. For Adversarial Training and TRADES methods, we adopt 10-step iterative PGD attack with step size 2/255 for both. For our proposed method, we set the backward smoothing parameter 7 1. For robust accuracy evaluation, we typically adopt 100-step PGD attack with step size 2/255, To ensure the validity of the model robustness improvement is not because of the obfuscated gradient (Athalye) the-art art attacks (Croce Hein 2020b
et al. 2018), we further test our method with current state-of -are--of-hh-eate
Chen & Gu 2020).
5.2
PERFORMANCE COMPARISON WITH ROBUST TRAINING BASELINES
We compare the adversarial robustness of Backward Smoothing against standard Adversarial Train-
ing (Madry et al. 2018). TRADES (Zhang et al. 2019). as well as fast training methods such as
We do not test on ImageNet dataset mainly due to that TRADES does not perform well ImageNet as mentioned in Qin al. 2019).

---

Under review as a conference paper at ICLR 2021
Fast AT Woon al. 2020 and our naive baseline Fast TRADES. We also compare with recently proposed Fast + method (Li et al.) 2020) that achieves high robustness with reduced training time Since proposed backward smoothing initialization utilizes an extra step of gradient back- propagation, we also compare with Fast TRADES using 2-step attack for fair comparison.
Table 2: Performance comparison on CIFAR-10 Table 3: Performance comparison on CIFAR-
using ResNet-18 model.
100 using ResNet-18 model.
Method
Nat (%) Rob (%) Time (m)
Method
Nat (%) Rob (% Time (m)
AT
82.36
51.14
430
AT
55.22
28.53
428
Fast AT
84.79
46.30
Fast
60.35
24.64
83
Fast AT (2-step)
83.21
49.91
127
Fast AT (2-step)
56.00
27.84
128
TRADES
82.33
52.74
482
TRADES
56.99
29.41
480
Fast TRADES
83.39
46.98
126
Fast TRADES
60.26
21.33
126
Fast TRADES (2-step)
83,51
48.78
164
Fast TRADES (2-step)
58.81
25.47
165
Backward Smoothing
82.38
52.50
164
Backward Smoothing
56.96
30.50
164
Table 2 shows the performance comparison the CIFAR-10 dataset using ResNet-18 model. Our Backward Smoothing method significantly closes the robustness gap between state-of-the-art ro- bust training methods, achieving high robust accuracy that is almost as good TRADES, while consuming much less (~ 3x) training time. Compared with Fast AT, Backward Smoothing typi- cally costs twice the training time, yet achieving significantly higher model robustness. Our method also achieves similar performance gain against Fast TRADES. Note that even compared with Fast TRADES using 2-step attack and Fast AT using 2-step attack, which costs about the same training time as ours, our method still achieves large improvement.
Table 3 shows the performance comparison on CIFAR-100 using Re model. We can observe patterns similar to CIFAR-10 experi- ments. Backward Smoothing achieves slightly higher robustness compared with TRADES, while costing much less training time. Com- pared with Fast TRADES using 2-step attack and Fast AT using 2-step attack, our method also achieves a large robustness improvement with roughly the same training cost. Table 4 shows that on Tiny ImageNet using ResNet-50 model, Backward Smoothing also achieves sig-
Table 4: Performance comparison Tiny Ima- geNet dataset using ResNet-50 model.
Method
Nat (%) Rob (%)
Time (m)
AT
44.50
21.34
2666
Fast AT Fast AT (2-step)
49.58
18.56
575
45.74
20.94
817
TRADES
47.02
21.04
2928
Fast TRADES Fast TRADES (2-step)
50.36
17.22
805
46.92
19.26
1045
Backward Smoothing
46.68
22.32
1035
nificant robustness improvement over other single-step robust training methods.
5.3 EVALUATION WITH STATE-OF- -HEEE-FF-TEEEAEE ART ATTACKS
To ensure that Backward Smoothing does not cause obfuscated gradient problem (Athalye et al. 2018) or presents false sense of security, we further evaluate our method using state-of-the-art at- tacks, by considering two evaluation methods: (i) AutoAttack (Croce & Hein 2020b). which is ensemble of four diverse (white-box and black-box) attacks (APGD-CE, APGD-DLR, FAB (Croce & Hein 2020a) and Square Attack (Andriushchenko al. 2019)) reliably evaluate robustness; (ti) RayS attack (Chen & Gu 2020),, which only requires the prediction labels of the target model (completely gradient- free) and is able detect falsely robust models. It also measures another ro- bustness metric, average decision boundary distance (ADBD), defined as examples' average distance to their closest decision boundary. ADBD reflects the overall model robustness beyond constraint. Both evaluations provide online robustness leaderboards for public comparison with other models.
We train our method with WideResNet-344 model (Zagoruyko & Komodakis 2016) and evaluate via AutoAttack and RayS. Table shows that under state-of-thh-art attacks, Backward Smoothing still holds high robustness comparable to TRADES. Specifically, in terms of robust accuracy, Back- ward Smoothing is only 2% behind TRADES, while significantly higher than AT (Madry et al.) 2018 and Fast AT (Wong et al. 2020). In terms of ADBD metric, Backward Smoothing achieves
*Since Li et al. 2020) does not have code released yet, we only compare with theirs in the same setting (combined with acceleration techniques) using reported numbers.
7

---

Under review as a conference paper at ICLR 2021
the same level of overall model robustness TRADES, much higher than the other two methods. Note that the gap between Backward Smoothing and TRADES is larger than that in Table 2 We want to emphasize that this is not mainly due to the stronger attacks but the fact that larger model architectures. Intuitively speaking, larger models have larger capacities and may need stronger attacks to reach some dark spot in the area.
using
Table Performance comparison with state-of-the -htthe- art robust models on CIFAR-10 evaluated by Au- toAttack and RayS.
Robust Accuracy (%)
48
Method
AutoAttack Rob (%)
RayS Rob (%)
45.62
Metric
ADBD
64
AT
44.04
50.70
0.0344
AT (early-stop)
49.10
54.00
0.0377
12
Median
Fast AT
43.21
50.10
0.0334
29.30
Mean
TRADES
53.08
57.30
0.0403
Smoothing
Fast TRADES
43.84
52.05
0.0348
Figure 5: Robustness stability of different fast robust training methods.
Fast TRADES (2-step)
48.20
54.43
0.0383
Backward Smoothing
51.13
55.08
0.0403
5.4
STABILITY AND COMPATIBILITY
Figure 5 shows that Backward Smoothing is much more stable than Fast AT with much smaller variance. Compared with Fast TRADES, Backward Smoothing has achieved similar variance while obtaining much higher average model robustness. This demonstrates the superiority robust- ness stability for Backward Smoothing method. We also wonder whether Backward Smoothing is compatible with Adversarial Training, i.e., can ing Fast AT? We test this on CIFAR-IC 10 using ResNet-18 model, and the resulting model achieves 4 0.35% robust accuracy, improving the stability of Fast AT as well the average robustness. However, the best run out of 10 trials does not achieve better robustness. We conjecture that the main reason for the deteriorated performance the different choices of inner maximization loss for Adversarial Training turbation generated on the output space, the Cross-Entropy loss mainly focuses on the y-logit while KL divergence is closely related to all logits. This partially explains the above observations.
similar initialization strategy for improv-
and TRADES (KL divergence). Considering the random per-
5.5 ABLATION STUDIES
We also perform set of ablation studies to provide a more in-depth analysis on Backward Smooth- ing. Due to the space limit, here we present the sensitivity analysis on smoothing parameter y and the step size, and leave more ablation studies in the supplemental materials.
Effect of 7: We analyze the effect of ς in Backward Smoothing by fixing and the attack step size. Table 6 summarizes the results. In general, 7 does not have a significant effect on the final model robustness; however, using too large or too small y would lead to slightly worse robustness. Empirically, 7 = 1 achieves the best performance on both datasets.
Table 7: Sensitivity analysis of the attack step size on the CIFAR-10 10 and CIFAR-100 datasets using ResNet-18 18 model.
Table 6: Sensitivity analysis on the CIFAR- 10 and CIFAR-100 datasets using ResNet-18 model.
Dataset
CIFAR-10
CIFAR-100
Dataset
CIFAR-10
CIFAR-100
Step Size
Nat (%)
Rob (%)
Nat (%)
Rob (%
7
Nat (%)
Rob (%)
Nat (%)
Rob (%)
6/255
81.38
52.38
$6.83
29.78
0.1
82.43
52.13
56.62
29.34
7/255
81.96
$2.40
56.61
29.82
0.5
82,53
52.34
56.95
29.85
8/255
82,38
52.50
56.96
30,50
1.0
82.38
52.50
56.96
30.50
9/255
82.47
52.16
56.45
29.35
2.0
82.29
52.42
56.16
29.88
10/255
81.71
52.04
60.85
24.21
5.0
81.50
52.32
56.10
429.83
11/255
67.43
42.45
40.40
20.92
12/255
65.56
41.12
37.90
18.83
'e also tested the ResNet-18 models in Table with AutoAttack and the gap between Backward Smooth- ing and TRADES is small 0.5%.
8

---

Under review as a conference paper at ICLR 2021
Effect of Attack Step Size: To verify the effect of attack step size, fix and 3. From Table can observe that different from single-step robust training methods, Backward Smoothing achieves similar robustness with slightly smaller step size, while the best performance is obtained with step size 8/ 3/255. This suggests that we do not need to pursue overly-large step size for better robustness in Fast AT: This avoids the stability issue in Fast AT.
5.6 COMBINING WITH OTHER ACCELERATION TECHNIQUES
Aside from random initialization, Wong et al. (2020) also adopts two additional accelera- tion techniques to further improve training ef- ficiency with a minor sacrifice on robustness performance: cyclic learning rate decay sched- ule (Smith) (017) and mix-precision training (Micikevicius et al. 2017). We show that such strategies are also applicable to Backward Smoothing. Table [ provides the results when these acceleration techniques are applied. We can observe that both work universally well for all methods, significantly reducing train- ing time (in comparison with Table 2). Yet does not alter the conclusions that Backward
Table Performance comparison on CIFAR-
10 using ResNet-18 model combined with cyclic learning rate and mix-precision training.
Method
Nat (% Rob (% Time (m)
AT Fast AT
81.48
50.32
62
83.26
45.30
12
Fast AT+ TRADES
83.54
48.43
28
79.64
50.86
Fast TRADES
84.40
45.96
18
Fast TRADES (2-step)
81.37
47.56
Backward Smoothing
78.76
50.58
24
Smoothing achieves similar robustness to TRADES with much less training time. Also when com- pared with the recent proposed Fast AT+ method, Backward Smoothing achieves higher robustness and training efficiency. Note that the idea of Fast AT+ method is orthogonal to ours and we can also adopt such hybrid approach for further reduction training time.
6 CONCLUSIONS
In this paper, we propose new understanding towards Fast Adversarial Training by viewing ran- dom initialization as performing randomized smoothing for the inner maximization problem. We then show that the smoothing effect by random initialization is not enough under adversarial pertur- bation constraint. To address this issue, propose new initialization strategy, Backward Smooth- ing. The resulting method closes the robustness gap to state-of-the-a robust training methods and significantly improves model robustness over single-step robust training methods.
REFERENCES
Abdullah Al-Dujaili and Una-May O'Reilly. Sign bits are all you need for black-box attacks. In ICLR, 2020.
Cean-Baptiste Alayrac, Jonathan Uesato, Po-Sen Huang, Alhussein Fawzi, Robert Stanforth, and Pushmeet Kohli. Are labels required for improving adversarial robustness? In NeurIPS, pp- 12214-1222, 2019.
Maksym Andriushchenko and Nicolas Flammarion. Understanding and improving fast adversarial training. Advances in Neural Information Processing Systems, 2020.
Maksym Andriushchenko, Francesco Croce, Nicolas Flammarion, and Matthias Hein. Square attack: a query-efficient black-box adversarial attack via random search. arXiv preprint 1rXiv:19/2.000049 2019.
Anish Athalye. Nicholas Carlini, and David Wagner. Obfuscated gradients give false sense of security: Circumventing defenses to adversarial examples. In ICML. 2018.
Stephen Boyd, Stephen P Boyd, and Lieven Vandenberghe. Convex optimization. Cambridge uni- versity press, 2004.
Wieland Brendel. Jonas Rauber, and Matthias Bethge. Decision-bant adversarial attacks: Reliable attacks against black-box machine learning models. In ICLR, 2018.

---

Under review as a conference paper at ICLR 2021
Nicholas Carlini and David Wagner. Towards evaluating the robustmess of neural networks. In SP, pp. 39-57. IEEE, 2017.
Yair Carmon, Aditi Raghunathan, Ludwig Schmidt, John C Duchi, and Percy Liang. Unlabeled data improves adversarial robustness, In NeurIPS, pp. 11192-11203, 2019.
Jinghui Chen and Quanquan Gu. Rays: A ray searching method for hard-label adversarial attack. In SIGKDD, 2020.
Jinghui Chen, Dongruo Zhou, Jinfeng Yi, and Quanquan Gu. A frank-wolfe framework for efficient and effective adversarial attacks. In AAAI, 2020.
Pin-Yu Chen, Huan Zhang, Yash Sharma, Jinfeng Yi, and Cho-Jui Hsieh. Zoo: Zeroth order opti- mization based black-box attacks to deep neural networks without training substitute models. In AlSec, pp. 15-26. ACM, 2017.
Minhao Cheng, Thong Le, Pin-Yu Chen, Huan Zhang, JinFeng Yi, and Cho-Jui Hsieh. Query- efficient hard-label black-box attack: An optimization-basee approach. In ICLR, 2019.
Minhao Cheng, Simranjit Singh, Patrick H. Chen, Yu Chen, Sijia Liu, and Cho-Jui Hsieh. Sign- opt: A query-efficient hard-label adversarial attack. In ICLR, 2020.
Jeremy Cohen, Elan Rosenfeld, and Zico Kolter. Certified adversarial robustness via randomized smoothing. ICML, pp. 1310-1320, 2019.
Croce and M. Hein. Minimally distorted adversarial examples with fast adaptive boundary attack. In ICML, 2020a.
Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In ICML, 2020b.
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In CVPR, pp. 248-255. Ieee, 2009.
Guneet S Dhillon, Kamyar Arizzadenesheli, Zachary C Lipton, Jeremy Bernstein, Jean Kossaifi, Aran Khanna, and Anima Anandkumar. Stochastic activation pruning for robust adversarial de- fense. ICLR, 2018
John C Duchi, Peter L Bartlett, and Martin J Wainwright. Randomized smoothing for stochastic optimization. SIAM Journal on Optimization, 22(2):674-701, 2012.
Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. ICLR, 2015.
Chuan Guo, Mayank Rana, Moustapha Cisse, and Laurens Van Der Maaten. Countering adversarial images using input transformations. ICLR, 2018.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. CVPR, pp. 770-778, 2016.
Dan Hendrycks, Kimin Lee, and Mantas Mazeika. Using pre-training can improve model robustness and uncertainty. In ICML, pp. 2712-2721, 2019.
Andrew Ilyas, Logan Engstrom, Anish Athalye, Jessy Lin, Anish Athalye, Logan Engstrom, Andrew Ilyas, and Kevin Kwok. Black-box adversarial attacks with limited queries and information. In ICML, 2018.
Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.
Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial examples in the physical world. arXiv preprint arXiv:1607.02533 2016.
Bai Li, Shiqi Wang, Suman Jana, and Lawrence Carin. Towards understanding fast adversarial training. arXiv preprint arXiv:2006.0300 2020.
10

---

Under review as a conference paper at ICLR 2021
Xingjun Ma, Bo Li, Yisen Wang. Sarah M Erfani, Sudanthi Wijewickrema, Grant Schoenebeck, Dawn Song, Michael E Houle, and James Bailey. Characterizing adversarial subspaces using local intrinsic dimensionality. ICLR, 2018.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. ICML, 2018.
Paulius Micikevicius, Sharan Narang, Jonah Alben, Gregory Diamos, Erich Elsen, David Garcia, Boris Ginsburg. Michael Houston, Oleksii Kuchaiev, Ganesh Venkatesh, et al. Mixed precision training. arXiv preprint arXiv: 1710.0370, 2017.
Seungyong Moon, Gaon An, and Hyun Oh Song. Parsimonious black-box adversarial attacks via efficient combinatorial optimization. In ICML, pp. 4636 4644, 2019.
Seyed-Mohsen Moosavi-Dezfore Alhussein Fawzi, and Pascal Frossard. Deepfool: simple and accurate method to fool deep neural networks. In CVPR, pp. 2574-2582, 2016.
Nicolas Papernot, Patrick McDaniel, Somesh Jha, Matt Fredrikson, Z Berkay Celik, and Ananthram Swami. The limitations of deep learning in adversarial settings. In EuroS&P, pp. 372-387 IEEE, 2016.
Chongli Qin, James Martens, Sven Gowal, Dilip Krishnan, Krishnamurthy Dvijotham, Alhussein Fawzi, Soham De, Robert Stanforth, and Pushmeet Kohli. Adversarial robustness through local linearization. In NeurIPS, pp. 13847-13856, 2019.
Leslie Rice, Eric Wong, and J Zico Kolter. Overfitting in adversarially robust deep learning. ICML, 2020.
Hadi Salman, Jerry Li, Ilya Razenshteyn, Pengchuan Zhang, Huan Zhang, Sebastien Bubeck, and Greg Yang. Provably robust deep learning via adversarially trained smoothed classifiers. In NeurlPS, pp- 1192-11133, 2019.
Pouya Samangouei, Maya Kabkab, and Rama Chellappa. Defense-gan Protecting classifiers against adversarial attacks using generative models. ICLR, 2018
Ali Shafahi, Mahyar Najibi, Mohammad Amin Ghiasi, Zheng Xu, John Dickerson, Christoph Studer, Larry S Davis, Gavin Taylor, and Tom Goldstein. Adversarial training for free! In NewrIPS, pp. 3358-3369, 2019.
Leslie N Smith. Cyclical learning rates for training neural networks. In WACV, pp. 464 472. IEEE, 2017.
Yang Song, Taesup Kim, Sebastian Nowozin, Stefano Ermon, and Nate Kushman. Pixeldefend: Leveraging generative models to understand and defend against adversarial examples. ICLR, 2018.
Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199 2013.
Yusuke Tashiro, Yang Song, and Stefano Ermon. Diversity can be transferred: Output diversffication for white-and black-box attacks. Advances in Neural Information Processing Systems, 33, 2020.
Yisen Wang. Xingjun Ma, James Bailey, Jinfeng Yi, Bowen Zhou, and Quanquan Gu. On the convergence and robustness of adversarial training. In ICML, pp. 6586-6595, 2019.
Yisen Wang, Difan Zou, Jinfeng Yi, James Bailey, Xingjun Ma, and Quanquan Gu. Improving adversarial robustness requires revisiting misclassified examples. In ICLR, 2020.
Eric Wong, Leslie Rice, and J. Zico Kolter. Fast is better than free: Revisiting adversarial training. In ICLR, 2020.
Cihang Xie, Jianyu Wang, Zhishuai Zhang, Zhou Ren, and Alan Yuille. Mitigating adversarial effects through randomization. ICLR, 2018.

---

Under review as a conference paper at ICLR 2021
Sergey Zagoruyko and Nikos Komodakis. 1rX1v:1605.07146. 2016.
Wide residual networks.
arXiv preprint
Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In ICML, pp. 7472-7482, 2019.
12

---

Under review as a conference paper at ICLR 2021
A RANDOMIZED SMOOTHING
Randomized smoothing technique (Duchi al. 2012) was originally proposed for solving convex non-smooth optimization problems. It is based on the observations that random perturbation of the optimization variable can be used transform the loss into smoother one. Instead of using only [xx and (x)) to solve
min L(x),
randomized smoothing turns to solve the following objective function, which utilizes more global information from neighboring areas:
min EE-U(-1,))((x+ uE),
(A.1)
where & is random variable, and u is a small number. Duchi et al. (2012) showed that randomized smoothing makes the loss (A.1) smoother than before. Hence, even if the original loss L non-smooth, it can still be solved by stochastic gradient descent with provable guarantees.
B ADDITIONAL ABLATION STUDIES
In this section, conduct additional ablation studies to provide comprehensive view to the Back- ward Smoothing method.
B. THE EFFECT OF |3
We conduct the ablation studies to figure out the effect of 3 in Backward Smoothing method by fixing and the attack step size. shows the experimental results. Similar to what B does in TRADES (Zhang et al. 2019), here in Backward Smoothing, 3 still controls the trade-off between natural accuracy and robust accuracy. We observe that with larger B, natural accuracy keeps decreasing and the best robustness obtained with 3 = 10.0.
Table 9: Sensitivity analysis of 3 on CIFAR-I0 10 and CIFAR-100 datasets using ResNet-18 model.
Dataset
CIFAR-10
CIFAR-100
Nat (%)
Rob (%)
Nat (%)
Rob (%
84.87
46.46
62.22
24.83
4.0
84.58
50.01
59.03
27.58
6,0
83,96
51.65
57.46
28.66
8.0
82.48
51.88
57.51
29.38
10.0
82.38
52.50
56.96
30.50
12.0
81.63
52.38
56.46
29.95
B.2 DOES BACKWARD SMOOTHING ALONE WORKS?
To further understand the role of Backward Smoothing in robust training, we conduct experiments on using Backward Smoothing alone, i.c., only use Backward Smoothing initialization but do not perform gradient-based attack at all. Table and Table I1 show the experimental results. We can observe that Backward Smoothing as an initialization itself only provides a limited level of robust- ness (not as good as single-step attack). This is reasonable since the loss for Backward Smoothing does not directly promote adversarial attacks. Therefore only serves as an initialization to help single-step attacks better solve the inner maximization problems.
Table 10: Performance of using Backward Smoothing alone on CIFAR-10 dataset using ResNet- model.
Table 11: Performance of using Backward Smoothing alone on CIFAR-100 dataset using ResNet-18 model.
Method
Nat (%) ) Rob (%)
Method
Nat (%
Rob (%
Fast AT
84.79
46.30
Fast AT
60.35
24.64
Fast TRADES
84.80
46.25
Fast TRADES
60.22
Backward Smoothing Alone
69.87
39.26
Backward Smoothing Alone 43.47
18.51
B.3 MORE EXPERIMENTS FOR BACKWARD SMOOTHING USING MULTIPLE RANDOM POINTS
We also conducted extra experiments using multiple random points for the Backward Smoothing method. As can be from Table 12 single random point already leads to similar performance
13

---

Under review as a conference paper at ICLR 2021
Table 13: Performance comparison on CIFAR-
Sensitivity analysis on the number of random points used in Back- ward Smoothing the CIFAR-I0 dataset using ResNet-18 model.
Table 12:
10 dataset using ResNet-18 model (c
16/255).
Method
Nat (%)
Rob (%)
Time (m)
# RandPoints Rob (%)
Time (m)
62.76
32.03
425
Fast AT
53.72
20.12
52.50
164
TRADES
62,09
28.63
470
2
52.67
204
Fast TRADES
56.55
17.47
137
5
52.70
316
Fast TRADES (2-step)
53.36
19.11
167
10
52.73
510
Backward Smoothing
63.47
25.04
164
as multiple random points but saves more time. Note that our target to improve the efficiency of adversarial training, therefore, we only single random point for randomized smoothing in proposed method.
B.4 MORE EXPERIMENTS FOR LARGER = 16/255
We also conducted experiments testing the larger = 16/255 case. As can be seen from Table Backward Smoothing still achieves significant improvements over other single-step adversar- tal training algorithms despite that Adversarial training actually obtains better results compared to TRADES. This verifies the effectiveness of the proposed method.
14


Reviews:
[{"review_id": "Qan3eHWT17Y", "reviewer": "AnonReviewer3", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "Summary: This paper seeks to reduce the training time of TRADES adversarial training. It tries to understand fast adversarial training methods (single-step adversary methods) by viewing the random initialization of the adversarial perturbation in the PGD steps as randomized smoothing, making the inner maximization (the adversary) easier. They find empirically that this smoothing isn't enough for vanilla fast adversarial training with the TRADES objective (in the sense that it doesn't improve much beyond fast AT after switching out the objective), requiring large step sizes that bring instability to training. Then, they aim to improve fast TRADES by their proposed algorithm, \"backward smoothing\", which first perturbs the output of the model and then solves the inverse problem to find the corresponding input that would make this perturbation. The intuition is to make sure that the smoothing averages over a variety of output values to get a stronger smoothing effect. This seems to give similar results to TRADES while cutting down the training time significantly (only two inner PGD steps).\n\nStrengths:\n- The paper is pretty clearly written, the results are impressive in terms of cutting down the training time of TRADES about 4x, and there are a substantial number of experiments, including fair comparisons with 2-step fast TRADES and on strong attacks. \n- Sometimes, the robust accuracy is even better than TRADES, but the clean accuracy is almost always a bit worse.\n- They use many steps of PGD (100 steps) for robust accuracy evaluation.\n- The method is relatively simple (similar mechanics to PGD), and uses only 2 inner gradient steps. It seems to give more stable results than fast AT or fast TRADES, although most of the stability gain seems to come from switching to the TRADES objective (Fig 5).\n\nWeaknesses:\n- My main concern is the backward smoothing method seems general but only really works for TRADES (and not PGD AT). The intuitions that motivate the method don't seem special to TRADES, so it would be good to have some understanding of this phenomenon. Can the intuition given in the paper be verified somehow? Also, other papers have shown that tweaking PGD-AT (such as using early stopping) allows it to get just as good or better results than TRADES, so it's not clear that we should necessarily prefer a method based on TRADES. \n- The authors mention the natural way to increase smoothing, which would be to use larger random perturbations. They argue that because of the norm constraint, we cannot increase the perturbations. However, even with the norm constraint it's clear that larger perturbations would not be the same as small perturbations, and could plausibly have a different effect. This point would be more convincing if there were some experiments just using larger perturbations for random initialization.\n- Fast TRADES seems to be at a different point of the tradeoff curve between natural accuracy and robust accuracy, and perhaps it responds differently to the TRADES hyperparameter. From Table 2,3 etc. , we can see that Fast TRADES tends to improve natural accuracy and be worse than robust accuracy than TRADES. Could tuning the hyperparameter for Fast TRADES be enough to emulate the TRADES result?\n\nOther/clarifications:\n- Can the authors clarify how $\\xi$ is initialized in eq 4.4? \n- Is there any insight to what differences between backward smoothing and TRADES are exposed with a stronger attack?", "extra_scores": {}, "extra_text": {}}, {"review_id": "GrbC_6RQPyX", "reviewer": "AnonReviewer2", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "**Summary:**\nThe paper proposes a new algorithm for performing fast adversarial training. The proposed algorithm consists in solving the inner maximization problem in the following way: first, one takes a step of projected gradient descent (PGD) wrt an auxiliary loss (motivated by the idea of backward smoothing), and then one takes another step of PGD wrt the original loss function which is the KL divergence as suggested by the TRADES paper. The authors argue that taking two steps of PGD wrt different losses leads (perhaps, surprisingly) to higher robustness compared to taking two steps of PGD wrt the same original loss function.\n\n\n**Pros:**\n- Better robustness of models when computations are bounded with only 2 steps of PGD to solve the inner maximization problem.\n- Thorough robustness evaluation which includes the recent AutoAttack.\n- Ablation studies that help to better understand the influence of the two main hyperparameters of the proposed method.\n- The paper is clearly written although I would rather disagree with the justifications for the proposed method (see below).\n\n\n**Cons:**\n- The explanations from Section “Why random initialization helps?” are not convincing because randomness is just one part of the solution proposed by Wong et al. (2020) to solve the inner maximization procedure. Another part is reducing the step size from 2\\*eps to 1.25\\*eps which effectively reduces the norm of the perturbation compared to standard FGSM as discussed in a recent related paper Andriushchenko & Flammarion (2020). Therefore, taking into account the crucial effect of the step size as shown in Fig. 3 in Wong et al. (2020), I don’t think there is a reason to believe that randomness *alone* has any positive influence on the solution of the inner maximization problem. This is my main concern as the whole paper is built on the connection to randomized smoothing. I would be open to raise the score if you can show that randomization alone (with a single $\\xi$ or even multiple $\\xi$ to approximate the expectation in Eq. (3.2)) with the full step size (2\\*eps) alone can prevent catastrophic overfitting and help to achieve better robustness.\n- All the experiments are performed for eps=8/255 which is close to the eps for which even standard FGSM leads to high robustness (e.g., see Fig. 1 in Andriushchenko & Flammarion (2020)). Thus, it would be highly beneficial to show that the proposed approach works equally well compared to the competing approaches for a higher eps, e.g. eps=16/255 on CIFAR-10.\n- The proposed procedure of backward smoothing already appears in the literature in [Diversity can be Transferred: Output Diversification for White- and Black-box Attacks](https://arxiv.org/abs/2003.06878) where they propose a very similar algorithm but with the goal of obtaining a better adversarial attack (and thus they use multiple steps of PGD to solve it instead of just one). Although this paper is not yet published (accepted at NeurIPS’20), I think it would be important to at least acknowledge this connection.\n- I am still quite surprised that for the inner maximization problem, taking two steps of PGD wrt *different* losses leads to higher robustness compared to taking two steps of PGD wrt the same original loss function. In order to rule out potentially suboptimal choice of the step size for *Fast TRADES (2-step)*, I would be interested in seeing results of a grid search over it, i.e. similarly to Table 7 but for *Fast TRADES (2-step)*.\n\n\n**Minor suggestions:**\n- Fig. 2: the best step size is at the boundary of the grid {10/255, 8/255, 7/255}, thus it would make sense to extend the grid with even smaller values of the step size to make sure that Fast TRADES is not reported with suboptimal hyperparameters.\n- I'm also a bit surprised that *\"Backward smoothing ... even outperforms the state-of-the-art robust training methods\"* since the SOTA robust training methods include much more steps of PGD and thus they solve better the inner maximization problem. Why is their performance worse? Can it be, for example, because their hyperparameters were not sufficiently tuned (unlike for proposed method)?\n- Table 5: the listed \"AT\" baseline is quite weak (44.04%) from Madry et al. (2018). It would be better to use the results / models from Rice et al. (2020) which show results of AT+early stopping comparable to that of TRADES.\n- Table 5: it would be useful to add *Fast TRADES (2-step)* to the table as this is the most interesting baseline.\n\n\n**Score:**\nMy current score is 4/10 but I would be willing to raise it if my first two concerns (mentioned in **Cons**) are resolved.\n\n------\n\n**Update after the public discussion:**\n\nThanks a lot to the authors for clarifying many details and providing additional experimental data. In the updated version of the paper, the authors improve the results of the baseline \"Fast TRADES (2-step)\" and add additionally a stronger baseline of \"Fast AT (2-step)\" (except on CIFAR-10 with eps=16/255 where it's missing). However, at least for eps=8/255 on CIFAR-10, CIFAR-100, Tiny ImageNet, the authors show consistent improvements over the baselines with comparable computational cost (\"Fast TRADES (2-step)\" and \"Fast AT (2-step)\"). This is an interesting result, although it's not clear to me whether it's specific to eps=8/255 or it would generalize also to higher epsilons such as eps=12/255 or eps=16/255. \n\nOn the other hand, I still think that the current motivation of the method is very incomplete and it is still unclear why the proposed method should work in the first place. Perhaps, it's a good idea to further develop the additional experiments about the curvature of the loss surface at different points in the input space.\n\nThen I think there is additional work to be done in terms of understanding what the proposed method actually does (even if we don't take into account how it was motivated -- via randomized smoothing or not). In particular, it's still completely unclear to me why 2 steps of PGD with respect to the original KL divergence (i.e. Fast TRADES (2-step)) works worse than first 1 step with respect to one KL-divergence and then 1 step with respect to another KL-divergence (i.e. Backward Smoothing). This seems quite ad-hoc and requires further explanations, in my opinion. Moreover, I find it also quite puzzling that Backward Smoothing even outperforms 10-step TRADES / AT as shown in Tables 3 and 4 -- not sure about a justification behind this.\n\nTaking into account all of this, I update my score from 4/10 to 5/10. I think the paper can still be improved in various ways: both in terms of the motivation and experimental results.", "extra_scores": {}, "extra_text": {}}, {"review_id": "4RM87Worw_B", "reviewer": "AnonReviewer4", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This work proposes backward smoothing as an advanced random initialization to improve a model's adversarial robustness. The paper is well-written and easy to follow. However, I have the following concerns:\n1) The paper argues that random initialization can help fast adversarial training because it helps improve the smoothness of the loss function. However, a recent work \"Understanding and Improving Fast Adversarial Training\" has a very nice explanation and solution on this problem, which is much more convincing to me.\n2) Even if I accept the condition that random initialization helps improve the smoothness of the loss function, the motivation showing in Figure 3 that the current smoothing effect by using random initialization is not sufficient can not convince me. It is definitely in the expectation that KL divergence between clean and adversarial examples would be much greater than random initialization. And I do not think that this can shed any light on the insufficient smoothness by the current random initialization.\n3) At the end of section 4, the authors mention that \"Note that the proposed Backward Smoothing seems also compatible with Adversarial Training. However, Adversarial Training does not contain terms using KL divergence loss, which may hinder its performance. We will show this empirically in Section 5.\" I tried to find experiments with backward smoothing applied to standard adversarial training but did not find these results. It would be good if the authors can point it to me if I missed them. Conditioned on  that we observe backward smoothing does not greatly help standard adversarial training, this failure case raises a great concern to me. Compared to random initialization, backward smoothing provides a better random initialization which can provide better smoothness. My question is: why a better random initialization can not generalize to standard adversarial training?\n4) For Table 5, it is necessary to include FAST TRADES as backward smoothing is mainly applied to TRADES.\n5) Does backward smoothing really help adversarial robustness or it just plays the tradeoff game between clean accuracy and adversarial robustness? For example in Table 8, comparing FAST Trades and backward smoothing, backward smoothing provides better adversarial robustness but sacrifices a big clean accuracy. \n\nIn all, I vote for a reject for the current version of this work.\n\n********After Discussion*************\nI thank the authors for answering my questions and performing additional experiments. Some of my concerned are addressed during the discussion stage. Therefore, I raise my score from 4 to 5. However,  I still hold my opinions that this work does not have a strong motivation, does not help too much for standard adversarial training and has a potential trade-off problem.", "extra_scores": {}, "extra_text": {}}, {"review_id": "4JwCGy-8Kp2", "reviewer": "AnonReviewer1", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "The paper proposes Backward Smoothing to close the gap in terms of robustness between standard multi-step and fast (one or two steps) adversarial training (AT). In particular, at high level, given a network $f$, a point $x$ and its logits $f(x)$ it suggests to first sample a random perturbation $\\psi$ in the logits space around $f(x)$ and second computing, via one step of gradient descent, $\\xi^*$ so to minimize the KL-divergence between the softmax values of $f(x) + \\psi$ and $f(x + \\xi^*)$. Then $x + \\xi^*$ is used as starting point for one-step AT. The rationale behind the scheme is that the random step commonly added to $x$ before AT might be not sufficient to achieve a smoothing effect on the loss function and then an effective optimization.\n\nPros\n1. The proposed method is simple and easily integrated into the TRADES training scheme.\n2. The empirical results are strong, as Backward Smoothing  achieves better robustness than other fast AT versions and is more efficient that multi-step AT (including TRADES) with little loss in robustness. Also, the models are thoroughly tested with many white- and black-box attacks.\n\nCons\n1. The theoretical explanation of why random initialization helps and the connection to randomized smoothing (Sec. 3) is not very convincing in my opinion. Randomized smoothing aims at estimating better directions for the gradient step, but it's not clear whether this is the case when using a single random point (this would need to be experimentally validated). An alternative explanation of the role of random initialization is presented in (Andriushchenko & Flammarion, 2020), which would be worth discussing.\n2. The proposed method seems to share some similarities with ODI (Tashiro et al., 2020), which also proposes a scheme to find good starting points for PGD-based adversarial attacks optimizing some (randomly sampled) loss in the logits space. While in that work there's no focus on adversarial training, the overall idea looks similar, and I think the authors should comment on this.\n\nOther comments and questions\n1. In the comparison to other methods, I think for completeness it'd be good to show also Fast AT with 2 steps, since it has the same computational cost as Backward Smoothing and Fast AT performs better than Fast TRADES especially on CIFAR-100 and Tiny ImageNet. Additionally, including other techniques for fast adversarial training (Shafahi et al., 2019, Andriushchenko & Flammarion, 2020) might give a more complete picture.\n2. In Table 5, the gap between Backward Smoothing and TRADES is larger than what reported in Table 2. Is this because of the larger architecture or just the evaluation with stronger attacks (or something else)?\n3. How does the proposed technique behave for larger $\\epsilon$? Is it still able to achieve results similar to multi-step AT (usually for larger $\\epsilon$ the gap between single- and multi-step AT becomes even larger)?\n\nOverall, as mentioned above, the paper presents strong empirical results which support the proposed method. However, the justification for the method as presented is not particularly convincing and should be better validated. Also, a discussion of the similarities with prior work seems needed.\n\nTashiro et al., \"Diversity can be Transferred: Output Diversification for White- and Black-box Attacks\"\n\n---\nUpdate after rebuttal\n\nAfter reading the authors' response and the other reviews, I think the paper has quite clear pros and cons.\n\nThe experimental results (especially at $\\epsilon=8/255$) are strong and the underlying idea of finding a good starting point for single step adversarial training makes sense to me (see reply below).\n\nOn the other side, the initial (and partially current) explanation relying on randomized smoothing given by the authors is not convincing, in particular when discussing the role of the random step in the success of Fast AT. The new experiments provided in the revision which rather analyze the smoothness of the starting point found by Backward Smoothing look like a much better explanation of the success of the proposed method (note that although the overlap of terminology I don't see a direct interpretation of the smoothness of the loss function at some specifically crafted point in terms of randomized smoothing). This should be more thoroughly analyzed and commented, which would consist in a quite major update of the paper in my opinion.\n\nThe current version doesn't provide an exhaustive motivation and analysis of the proposed method (in any direction, randomized smoothing or others), although the revision improves in this sense. Then, although I appreciate the good empirical results and I'm still in favor of the proposed method, I have to lower the score. I encourage the authors to clarify the weaknesses of the paper, which might result in a better understanding of what's needed for a successful fast adversarial training.", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: This paper studies efficient robust training. The key idea is to use backward smoothing as an advanced random initialization to improve a model's adversarial robustness. The approach is sound, well grounded, and quite logical. Results demonstrate the effectiveness.

However, there exists some limitations:

1) Andriushchenko & Flammarion, 2020 gives a better and more fundamental explanation on how to address fast adversarial training.

2) Backward smoothing does not generalize to standard adversarial training. In other words, it only works for KL divergence loss rather than cross-entropy loss, and it seems that backward smoothing does not address the fundamental problem of fast adversarial training.

3) If we compare the performance of Fast TRADES and Backward Smoothing since Backward Smoothing intends to improve Fast TRADES, there is always a tradeoff between clean accuracy and adversarial robustness, e.g., Table 4 and Table 8. 

4) Randomized smoothing is helpful for one-step adversarial training and randomized smoothing in general seems to be orthogonal to the proposed method. Moreover, 2-step PGD training can perform similarly well to backward smoothing while being much simpler conceptually.

In the end, I think that this paper may not be ready for publication at ICLR, but the next version must be a strong paper if above limitations can be well addressed.
Decision: Reject