Bag of Tricks for FGSM Adversarial Training 
Authors: Zichao Li
Li Liu
Zeyu Wang
Yuyin Zhou
Cihang Xie
Venue: Submitted to ICLR 2023 (2023)
Keywords: adversarial training

Abstract: Adversarial training (AT) with samples generated by Fast Gradient Sign Method (FGSM), also known as FGSM-AT, is a computationally simple method to train robust networks. However, during its training procedure, an unstable mode of ``catastrophic overfitting'' has been identified in [Wong2020FastIB], where the robust accuracy abruptly drops to zero within a single training step. Existing methods use gradient regularizers or random initialization tricks to attenuate this issue, whereas they either take high computational cost or lead to lower robust accuracy. In this work, we provide the first study, which thoroughly examines a collection of tricks from three perspectives: Data Initialization, Network Structure, and Optimization, to overcome the catastrophic overfitting in FGSM-AT. 

Surprisingly, we find that simple tricks, i.e., a) masking partial pixels (even without randomness), b) setting a large convolution stride and smooth activation functions, or c) regularizing the weights of the first convolutional layer, can effectively tackle the overfitting issue.
Extensive results on a range of network architectures validate the effectiveness of each proposed trick, and the combinations of tricks are also investigated. For example, trained with PreActResNet-18 on CIFAR-10, our method attains 49.8% accuracy against PGD-50 attacker and 46.4% accuracy against AutoAttack, demonstrating that pure FGSM-AT is capable of enabling robust learners. 

Under review as a conference paper at ICLR 2023
BAG OF TRICKS FOR FGSM ADVERSARIAL TRAINING
Anonymous authors Paper under double-blind review
ABSTRACT
Adversarial training (AT) with samples generated by Fast Gradient Sign Method (FGSM), also known as FGSM-AT, is a computationally simple method to train robust networks. However, during its training procedure, an unstable mode of "catastrophic overfitting" has been identified in (Wong et al.) 2020), where the robust accuracy abruptly drops to zero within single training step. Existing methods use gradient regularizers or random initialization tricks to attenuate this issue, whereas they either take high computational cost or lead to lower robust accuracy. In this work, we provide the first study, which thoroughly examines a collection of tricks from three perspectives: Data Initialization, Network Structure, and Optimization, to overcome the catastrophic overfitting in FGSM-AT.
Surprisingly, we find that simple tricks, i.e., a) masking partial pixels (even without randomness), b) setting large convolution stride and smooth activation functions, <) regularizing the weights of the first convolutional layer, can effectively tackle the overfitting issue. Extensive results on a range of network architectures validate the effectiveness of each proposed trick, and the combinations of tricks are also investigated. For example, trained with PreActResNet-I1 18 on CIFAR- 10, our method attains 49.8% accuracy against PGD-50 attacker and 46.4% accuracy against AttoAt demonstrating that pure FGSM-AT is capable of enabling robust learners.
INTRODUCTION
Convolution neural networks (CNNs), though achieving compelling performances on various visual
recognition tasks, are vulnerable to adversarial perturbations (Szegedy al. 2014). To effectively defend against such malicious attacks, adversarial examples are utilized as training data for enhancing model robustness, process known adversarial training (AT). To generate adversarial examples, one of the leading approaches is to perturb the data using the sign of the image gradients, namely the Fast Gradient Sign Method (FGSM) (Goodfellow et al. 2015).
The adversarial training with FGSM (FGSM-AT) is computationally efficient, and it lays the founda- tion for many followups (Kurakin et al. 2017 Tramèr et al. 2018 Madry et al. 2018 8) Xie et al.) 2019)] Zhang et al. 2019). Nonetheless, interestingly, FGSM-AT is not widely used today because of the catastrophic overfitting: the model robustness will collapse after a few training epochs (Wong et al. 2020). Several methods are proposed mitigate catastrophic overfitting and stabilize FGSM-AT. For instance, (Wong et al. 2020) pre-add uniformly random noises around images to generate adversarial examples, i.e., turning the FGSM attacker into the PGD-1 attacker. (Andriushchenko & Flammarion 2020) propose GradAlign, which regularizes the AT via explicitly maximizing the gradient alignment of the perturbations. While these approaches successfully alleviate the catastrophic overfitting, there are still some limitations. For example, GradAlign requires an extra forward pass compared to the vanilla FGSM-AT, which significantly increases the computational cost; Fast-AT (Wong et al., 2020) shows relatively lower robustness, and may still collapse when used to train larger networks or applied in the unggerperturrbation settings.
In this paper, aim to develop more effective and computationally efficient solutions for attenuating catastrophic overfitting. Specifically, we revisit FGSM-AT and design to stabilize its training from the following three perspectives:
Data Initialization. Following the idea of adding random perturbations in Maddr et al. 2018 Wong al. 2020), we propose to randomly mask subset of the input pixels stabilize FGSM-AT,

---

Under review as a conference paper at ICLR 2023
dubbed FGSM-Mask. Surprisingly, additional analysis suggests that the randomness of the masking process may not be necessary during training- we find that applying pre-defined masking pattern the training set also effectively stabilizes FGSM-AT. This observation also holds for adding perturbations as the attack initialization in (Wong et al. 2020), challenging the general helief that randomness is of the key factors for stabilizing AT.
Network Structure. We identify two architectural elements that affect FGSM-AT. Firstly, in addition to boosting robustness as shown (Xie al.) (020), we find that smoother activation function can make FGSM-AT more stable. Secondly, we find vanilla FGSM-AT can effectively train Vision Transformers (VīTs) (Dosovitskiy al. 202T) without showing catastrophic overfitting. We conjecture this phenomenon may be related how CNNs and VITs extract features: i.e., CNNs typically extract features from overlapped image regions (i.e., stride size < kernel size in convolution), while ViTs extract features from non-overlapped image patches (i.e, stride size kernel size in convolution). By simply increasing the stride size the first convolution layer in a CNN, validate that the resulting model can stably train with FGSM-AT.
Optimization. Inspired by GradAlign (Andriushchenko & Flammarion 2020), we propose ConvNorm, a regularization term that simply constrains the weights of the convolution layer to stabilize FGSM-AT. Different from GradAlign which introduces a significant amount of extra computations, our ConvNorm works as nearly computationally efficiently as the vanilla FGSM-AT.
Our contributions. In summary, we discover a bag of tricks that effectively alleviate the catastrophic overfitting in FGSM-AT from three different perspectives. We extensively validate the effectiveness of our methods with a range of different network structures on the popular CIFAR-101 100100 datasets, using different perturbation radii. Our results demonstrate that only using FGSM-AT is capable of enabling robust learners. We hope this work can encourage future exploration on unleashing the potential of FGSM-AT.
PRELIMINARIES
Given neural classifier f with parameters 0, we denote æ and y as the input data and the correspond- ing label from the data generator D, respectively. 5 represents the adversarial perturbation, c the maximum perturbation size under the I -norm constraint, and L is the cross-entropy loss typically used for image classification tasks.
Adversarial Training: (Madry optimization problem:
2018 formulates the adversarial training as min-max
min E (aa))D
max C(fo(x v)]
Among different attacks for generating adversarial examples, chose two popular ones to study:
FGSM: (Goodfellow et 2015) first proposes Fast Gradient Sign Method (FGSM) to generate the perturbation ö in a single step, as the following:
(V ( ((((f()))
(2)
PGD: (Madry et 2018 proposes strong iterative version with random start based on FGSM, named Projected Gradient Descent (PGD):
Dt+1
[[li (I: + asign ((f((())
where denotes the step size of each iteration, denotes the adversarial examples after steps, and [[ refers to the projection to the Ball. Compared to FGSM, PGD provides a better choice for generating adversarial examples, but it will also be much more computationally expensive. In the following sections, we call adversarial training with FGSM as FGSM-AT, and correspondingly. with PGD PGD-AT.
2

---

Under review as a conference paper at ICLR 2023
Catastrophic Overfitting: (Wong al. 2020) argues that non-zero initialization for perturbatioon the key to avoiding the overfitting issue in adversarial training, and proposes to add uniformly random noises around clean images the attack initialization. The detailed procedure is illustrated in the following equations:
r Uniform(-c,))
8 = 8 + sign V2 + n)),
max(min(6, -c))
The later work (Andriushchenko & Flammarion 2020) alternatively proposes GradAlign to stabilize FGSM-AT, which maximizes the gradient alignment between various sets as:
B( cos (V=L(fo()),)), V v]f(f(( v))]
(5)
BAG OF TRICKS
We aim to investigat simple yet effective solutions to overcome catastrophic overfitting in FGSM- AT. Specifically, our methods are developed from three general perspectives: Data Initialization, Network Structure, and Optimization. We extensively test these methods on the popular CIFAR-10 10 dataset (Krizhevsky & Hinton, 2009) with PreActResNet-18 (He et al. 2016). We set the maximum perturbation size
8/255 under the -norm constraint. Unlike (Rebuffi et al. 2021 Gowal et al. Sehwagg et al. (022), the training data comes exclusively from CIFAR- 10 and no extra data used. Two adversarial attacks are considered for comprehensively evaluating model robustness: a) PGD-50 attacker (Madry et al. 2018) with 10 random restarts (PGD-50-10), where we apply untargeted mode using the ground truth annotations and set the step size a 2/255; and b) the AutoAttack (AA) suite (Croce & Hein 2020b), which includes Luuto-PGD-CE
FAB (Croce& & Hein, 2020a). and Square attack (Andriushchenko al. 2020
Adversarial training setups. We set the training framework and hyper- parameters following (Pang al. 2021). We apply an SGD optimizer with momentum of 0.9, weight decay of 10 and an imtiaa learning rate of 0.1. We do not apply label smoothing and set ReLU as the default activation function. We apply random flip and random crop to pre-process training data, and train models for a total of 110 epochs. The learning rate decays by 10x at 100 epoch and 105*h epoch, respectively. We use the last checkpoint to run robustness evaluations 3 times independently, and report results in the format of mean + var. All of our experiments are conducted with NVIDIA TITAN XP GPUs.
3.1 DATA INITIALIZATION
(Wong et al. 2020 first identifies the catastrophic overfitting phenomenon in FGSM-AT and proposes to solve it by adding uniformly random noise around images as attack initialization, namely Fast FGSM-AT (F+FGSM). Though this method has shown the capability to prevent general catastrophic overfitting, attains relatively lower robustness (i.e., the second row in Ta Moreover, the later work (Andriushchenko & Flammarion, 2020) argues that Fast FGSM-AT may still collapse when used to train larger networks or applied the larger-perturbation setting.
Methods PGD-I0 10
Clean
PGD-50-10
AA
82.620.15 15%
51.940.07%
48.2+0.06%
F+FGSM
86.3+0.02%
45.4+0.03%
41.0+0.03%
FGSM-Mask
82.4+0.01 %
48.5+0.01%
44.2+0.009
MGGM--Makkia fixed
80.7=0.0153 %
47.2+0.02%
43.0a0.02%
Table 1: Robustness of different data initialization methods combined with FGSM-AT.
FGSM-Mask. Inspired by the core idea of F+FGSM, in this paper, we first propose to mask a random subset of the impul pixels stabilize the training procedure of FGSM-AT, which term as FGSM- Mask. Figure [ illustrates the differences between FGSM-Mar -Mak and F+FGSM when generating adversarial examples. Specifically, at each iteration, FGSM-Mast zeros out some randomly chosen pixels of each image x with mask M according to a given mask ratio; then the masked image x. 69 M fed the model generate adversarial examples via FGSM as:
8 sign (V C(Jo M). y)),
(6)
3

---

Under review as a conference paper at ICLR 2023
add mask
after FGSM-Mask
add middom naise
xffeer F+FGSM
Figure The illustration of the differences between FGSM-Mask and F+FGSM on initializing images for attacking.
Compared with the random noise initialization method in F+FGSM (i.e., Equation equation 4 our method presents a much simpler FFSSM-tioon-FSMMMaaaa simply randomizes the mask instead of manipulating the original pixel values.
To demonstrate the effectiveness of FGSM-Mask, we mask images with different ratios and report the corresponding robust accuracy in Table and Tigure[(aa) Firstly, with mask ratio of 0%, FGSM- Mask degenerates to the vanilla FGSM-AT, and therefore it suffers from catastrophic overfitting. As the mask ratio increases, the models trained with FGSM-Mask become more stable. For example, small mask ratio like 10% 20% can already largely mitigate the overfitting issue; the robustness only collapses at nearly the end of training. Furthering mask ratio to 30% or above can completely resolve this issue: the robust accuracy remains stable and smooth during the training process. Specifically, we note a mask ratio of 30% competitively leads to 48.5% robust accuracy against PGD-50-10 and 44.2% robust accuracy against AA, outperforming F+FGSM (45,4% in PGD-50-10 and 41.0 41.0% in AA) by more than 3% shown in Table
50
Robust Accuracy(%)
Robust Accuracy(
40
30
30
20
0%
10-
50%
Epochs
Epochs
(a) FGSM-Mask
(b) FGSM-Mask-fixed
Figure 2: Robust accuracy of FGSM with various mask ratios ranging from 0% to 50%. (a) is with the random mask, and (b) is with the fixed mask.
FiseeM Additionally, we observe surprising result that the
Randomized Mask Ratio
Fixed
PGD-50-10
PGD-50-10
Mask Ratio
randomness of masking is not even
0-20%
0.0%
0.0-20%
0.0%
necessary-inseaad, simply using a fixed masking pattern per image throughout the whole training process is enough to help stabilize FGSM-AT. In other words, we could pre-define masked dataset offline that naturally enables the stable
30%
48.5%
30%
0.0%
40%
47.9%
40%
47.2%
50%
47.6%
50%
47.2%
Table 2: Robust accuracy of FGSM-Mask and FGSM-
Mask-Fixed when applied with different mask ratios.
4

---

Under review as a conference paper at ICLR 2023
Robust Accuracy
40
Robust Accuracy(
30-
20
Epochs
Epochs
Figure 3: Robust accuracy of CVT with differ- maximum perturbation size e {8, 16).
Figure 4: Robust accuracy of CNN with differ- stride sizes in the first convolution layer.
training of FGSM-AT, We call this method CGSM-MMakk-Fingg Fixed. As shown in Table 2 and Figure 2 (b), models trained with FGSM-Mask-Fixxe achieve strong robust accuracy without applying any additional tricks. For example, with mask ratio of 50%, the model trained with FGSM-Mask-Fiin attains robust accuracy of 47.2% against PGD-50-10. 10, outperforming the F+FGSM baseline by about 2%.
This observation further inspires us to revisit the random noise initialization strategy in F+FGSM Following PGSM-Mask-Fixed we directly apply a fixed noise pattern per image to the whole dataset. Interestingly, we note that such a strategy also capable of helping FGSM-AT prevent catastrophic overfitting, achieving robust accuracy of 45.2% against PGD-50-16 This finding challenges the previous belief that the randomness of initialization at each training iteration plays vital role in ensuring the success of AT (Wong al.
2020 Chen et al. 2022
3.2 NETWORK STRUCTURE
Existing studies demonstrate that a well-designed network structure can improve model robustness
(Xie et al., 2019: 2020 Singla et al. 2021, Wu et al.) [221 Guo et al. 2020 [Brgee et al. 2022
Tang et al. 2021 J. We hereby are interested in the newly emerged ViT architecture, which shows
better potentials than CNN in robustness (Bai et al.) [2021 Paul & Chen 2022 Shao al. (021)) We
choose Compact Vision Transformer (CVT) (Hassani et al. (021)) as the specific instantiation ViT
architecture, and check whether CVT will encounter catastrophic overfitting in FGSM-AT.
Figure 3 shows robust accuracy during the training process. We can observe that, without any additional tricks, CVT smoothly gains robustness along the training. This conclusion still holds when training with a much more challenging adversary (i.e., increasing the maximal perturbation bigger variation in the robust accuracy along the training, CVT
size from 8 to 16): though still successfully avoids catastrophic overfitting and attains a non-trivial final performance. These explore whether traditional CNN architectures can be improved address the catastrophic overfitting problem in FGSM-AT, an aspect largely overlooked in previous studies. More specifically, we plan to borrow existing modules from ViT help CNNs tackle catastrophic overfitting in FGSM-AT, which we detail next.
results motivate
Methods
Clean
PGD-50-10
AA
PGD-10
82.620.15%
51.920.07%
48.2+0.065
FGSM-Str2
83.120.02%
47.220.05%
44.420.03%
FGSM-Smoot
74.950.09%
47.0=0.07%
43.020.03%
Table 3:
Robustness of different neural architectural modifications combined with FGSM-AT.
Larger stride for the first convolution layer. One big difference between ViTs and CNNs is how they process image inputs. ViTs begin with a patchify operation, which first splits image into a sequence of non-overlapping patches, and then projects each patch with a trainable linear layer. This is usually implemented by convolution with large stride (e.g. 4 for CVT CIFAR-10). Whereas CNNs usually adopt a much more mild downsampling strategy. Take PreActResNet-18 example: its first layer is 3 convolutional layer with stride of To mimic ViT',
5

---

Under review as a conference paper at ICLR 2023
60-
Robust Accuracy
40-
Robust Accuracy(
40-
30-
30
20
Rel SUU
20-
BLU
apha-2
10-
apha-5
apha-10
20
40
60
60
160
100
Epochs
Epochs
Figure 5: (a) shows robust accuracy with various activation functions. (b) shows the robust accuracy under Softplus with different
propose to enlarge the stride of the first convolution layer of CNN: Interestingly, we note that the catastrophic overfitting problem is alleviated by simply increasing the stride size from 1 to 2 or 3. As shown in Figure 4 when the stride is set to 1, the robust accuracy quickly drops to zero; but when the stride is set to 2 or 3, the robust accuracy becomes more stable along the training. Among different stride options in our study, we find that FGSM-AT with a stride of 2 achieves the highest robust accuracy, i.e., 47.2% against PGD-50-10 as shown Table 3
We name this method FGSM-Str2.
Smooth activation function. Another important difference between ViTs and CNNs is the activation function. The common choice of CNNs' activation function is ReLU, while ViTs typically adopt smoother activation function, GELU (Hendrycks & Gimpel 2016). Previous studies have shown the effectiveness of smooth activation function in boosting model robustness (Xie et al. 2020 Singla et al., 2021 Gowal et al. 2020), but none of them studies it from the perspective of tackling catastrophic overfitting, which we aim to study here. Specifically, we experiment with replacing ReLU with four different smooth activation functions: SiLU (Ramachandran et al. 2018), ELU (Clevert et al. 2016), SoftPlus (Nair & Hinton 2010), and GELU (Hendrycks & Gimpel 2016). We show their robust accuracy along FGSM-AT in Figure F(a).
observe that all four activation functions largely mitigate even fully prevent catastrophic overfitting. More interestingly, we notice the degree of smoothness affects the robustness. For instance, ELU is smoother than GELU, and accordingly. the robust accuracy of ELU is stabler than that of GELU along the training. Following (Xie et al.) (2000), we choose Parametric SoftPlus to systematically study the effect of function smoothness, by adjusting the scalar a:
Firstly,
1 f(a, x) = log(1 + exp(ax))
Figure b)) shows the robust accuracy of Parametric SoftPlus with varying a along the training. With smaller value of a, we can validate that the activation function becomes smoother and the robust accuracy becomes stabler along the training. We choose Parametric SoftPlus with a = 2 as our baseline shown in Table as it performs the best among smooth activation functions. We call this method PGSM-Smooth
3.3
OPTIMIZATION
Previous works show that adding an extra regularization term can effectively prevent catastrophic overfitting in FGSM-AT. However, these methods usually introduce extra computation overhead. One typical example is GradAlign (Andriushchenko & Flammarion 2020). which significantly increase training
an forward and backward propagation is required compute the gradient of an adversarial set [aL(f(rr: + 1T), y) (see Equation equation 5). We hereby introduce two alternative approaches to stabilize FGSM-AT: directly regularizing the La norm of gradients on input images, referred to as GradNorm; and b) regularizing the weights on the first layer, referred to as WeightNorm.
As larger stride will lead to smaller feature map, we meanwhile decrease the stride of one intermediate convolution layer keep the size of the final feature map stay the same.

---

Under review as a conference paper at ICLR 2023
50
Robust Accuracy("s
30
104
10
A-10
2-12
Epochs
Epochs
Figure 6:
Trend of V along training. It
Figure 7: Robust accuracy w.r.f. different À in the proposed WeightNorm (see Equation 9h.
abruptly increases when overfitting happens.
Methods
Clean
PGD-50-10
AA
PGD-10
82.6+0.155 15%
51.9+0.07%
48.2+0.069
TGSM+GradAligg
81.2+0. 12%
47.6+0. 14%
14.0+00066%
FGSM+GradNorm
82.3+0.03%
45.9#0.04%
42.7+0.0455
FGSM+ WeiMghtoonn
81.7+0.02%
46.9#0.00%
42.8+0.01 %
Table 4: Robustness of different optimization methods combined with FGSM-AT.
GradNorm. By taking a closer look at the Ly norm of gradients V| ll2 on imput images, we observe that it abruptly increases by ~6x at the 11 th epoch (i.e., catastrophic overfitiing happens) shown in Figure [ This observation aligns with the conclusion in (Kim et al.) 2021). which points out that the increasing gradient norm leads decision boundary distortion and highly curved loss surface during adversarial training. This distortion makes the adversarially trained model vulnerable multi-step adversarial attacks (e.g., PGD attacks). Inspired by this phenomenon, we propose a new regularizer that directly constrains the gradient norm E [
L = C(fo(z 8) + B| lll
(8)
where 3 controls regularizing strength. As shown in Table 4 GradNorm successfully overcomes overfitting and achieves high robust accuracy of 45.9% against PGD-50-10, which comparable GradAlign (47.6 447. Nonetheless, drawback of GradNorm is that it requires even more computations than GradAlign. For example, with our hardware setup for one-epoch training, GradAlign takes 56s, while GradNorm nearly doubles the cost to 109s. The main reason is that regularizing the gradient norm involves second-order backpropagation, which is computationally expensive.
WeightNorm. Both GradAlign and GradNorm are highly effective in addressing the overfitting issue. However, they both suffer from high computational costs due the additional backpropagation requirement. To address the overfitting issue and meanwhile without significantly introducing extra computations, we propose to directly enforce the intermediate feature difference between adversarial examples and clean samples to be small, as
min XC (flz)
where the À controls the weight of the regularizer and 0 is the adversarial perturbation.
Note that Adversarial Logits Pairing (ALP) (Kannan et al. 2018) be regarded special example of WeightNorm, where the regularized intermediate feature is the logits /logits- We hereby take another simple instantiation: we regularize the intermediate features generated by the first convolution layer fu., where denotes the weights of the first convolution layer. Then fw, (x + 8) fw, (x) can be re-written as wi (x + 6) wiE which is equal to w18. regularizing computationally expensive second-order backpropagation, we therefore treat 5 here as a constant and only to regularize w1. Experiment result in Thow that WeightNorm can prevent catastrophic overfitting, Moreover, WeightNorm (42s/epoch) introduce very little extra computations to FGSM-AT (40s/epoch), and runs ~255 % faster than GradAlign. It is also worth mentioning that WeightNorm is robust to the choice of the hyperparameter in Equation equation 9 For example, by ranging À between and 12, WeightNorm always reliably prevents catastrophic overfitting, as shown in Figure
involves the
7

---

Under review as a conference paper at ICLR 2023
3.4 COMPONENTS COMBINATION
As shown in previous experiments, each proposed approach alone can mitigate the catastrophic overfitting problem. We next explore their possible synergy and report the results in Table Firstly, we observe that all these combinations can successfully prevent overfitring. Specifically, three combinations, Mask + Smooth, Str2 Smooth, and Str2 + Smooth + WeightNorm, yield the most effective solutions, i.e., they all report 49.6% or stronger robust accuracy against PGD-50- 10 and 46.0% or stronger robust accuracy against AA. This observation also corroborates the conclusion in (Xie et al. (020) that the smooth activation function can substantially strengthen adversarial training. But meanwhile, we note, for the combinations like Mask + Str2 or Mask WeighuNorm, they do not show further improvements. This observation suggests that approaches like Masking only help prevent catastrophic overfitting, As a side note, given that the GradNorm (which incur heavy computations) is excluded here, all these combinations can run fast as (or even faster than) the vanilla FGSM-AT.
Methods
Performances
Mask Mask-Fixed Str2 Smooth GradNorm WeightNorm
Clean
PGD-50-10
AA
82.4+0.04%
47.3+0.09%
44.4=0.109 10%
81.120.06%
49.720.0.5%
46.120.02%
81.740.04%
46.9+0.03%
42.8+0.02%
82.140.04%
49.8%0.07%
46.420.02%
81.2+0.03%
49.6+0.09%
46.0#0.05%
Table 5: Performances of FGSM-AT with combined tricks.
4 ABLATIONS
Large networks. Compared with small networks, larger networks are more likely to get overfitted the training data, making preventing catastrophic overfitting more challenging. For example, as shown in Table when increasing the network size from PreActResNet--1 18 to WideResNet-344 10, F+FGSM now fails to secure its robustness, i.e., attaining 0% robust accuracy against PGD-50 or AA. This motivates us to re-validate the effectiveness of our proposed methods, using the large WideResNNet33-10.
Methods
AT
Clean
PGD-50-10
AA
F+FGSM
89.4%
0%
0%
Baseline
FGSM+GradAlign
85.4%
51.2%
46.8%
PGD-10
86.1% 1%
55.2%
52.2%
FGSM-Mask
80.0%
34.4%
31.6%
Data initializatoin
71.8%
23.5%
21.0%
FGSM-Smooth
75.2%
46.9%
44.1%
Network Structure
FGSM-Str2
85.1%
47.0%
46.0%
FGSM+GradNorm IGGSM+WeighiNNe 84.6%
82.6%
49.2%
46.1%
Optimization
46.8%
44.8%
Table 6: Robust accuracy of different methods combined with FGSM-AT, using the large WideResNet- 34-10. Note for methods in data initialization, we need to set large masking ratio (i.e., 70% in our experiments) keep FGSM-AT stable.
We report the results in Table 6 Firstly, we note that all proposed methods can successfully prevent overfitting, i.e., none of them gets zero robust accuracy. Nonetheless, we note that the effectiveness of different methods varies a lot. For example, while for methods like Str2 help WideResNNet-4-11 10 secures competitive robustness (e,g., 46.0% against AA), FGSM-Mask or FGSM-Maske attains 20%~~0% robust accuracy against AA. Next, similar to the results in Table 3 we note that combining methods can help WideResNet-S44 34-10 attain higher robustness. For example, by adopting both the smooth activation function and a large stride size FGSM-AT, WideResNNet- 34- achieves 50.4% robust accuracy against PGD-50-B 10 and 47.3% robust accuracy against AA.
only
8

---

Under review as a conference paper at ICLR 2023
Larger perturbation. As mentioned in (Andriushchenko & Flammarion 2020). large perturbation will nullify the defense built by F+FGSM. We hereby aggressively increase the maximal perturbation size from 2 to 16 to validate the effectiveness of our proposed methods. As shown in Figure most of our methods can still attain non-trivial robustness against PGD-50-10, demonstrating that they can reliably address the catastrophic overfitting when facing larger perturbations.
CIFAR-100 dataset. The main experiments of this paper foeus on robustness in CIFAR-10. We hereby validate whether methods can stabilize FGSM-AT CIFAR-100 as well. As shown Table / while vanilla FGSM fails to secure model robustness, all our methods can reliably address the catastrophic overfitting issue on CIFAR-100.
Vandla FGSM
Methods
Clean
PGD-50-10
FCSM-Mask
Robust Accuracy (%))
70-
Fack-Maukliked
Vanilla FGSM
46.7%
0%
FCSM Smooth
FISH Str2
FGSM-Mask
56.4%
25.3%
50
FCSM WeightNorm
FGSM-Mas Mask-Fixed
52.3%
22.4%
GradNorm
40-
FGSM-Smooth
51.6%
25.7%
FGSM-Str2
57.9%
25.2%
FGSM-GradNorm
51.6%
22.3%
FGSM- NorM-
52.8%
23.1%
used for training and evaulation
12
16
Table 7: Model performances on CIFAR-100.
Figure The robust accuracy of different methods when (perturbation size) increases.
RELATED WORK
Adversarial training. Adversarial training is one the most effective strategies to defend against adversarial threats machine learning systems. The idea of adversarial training origins in (Good- fellow et al., 2015) who proposes to combine clean samples and adversarial examples to train the model. (Madry et al. 2018) reformulate adversarial training as min-max optimization problem and proposes the PGD adversarial attack, inspiring set of follow-ups. (Zhang et al., (2019) apply regularization term achieve the balance hetween robustness and clean performance. (Shafahi et al.. 2019) reduce the high cost of adversarial training by recycling the gradient information. Recent works also summarise the tricks AT. For example, (Pang et al. [022)) reports the optimal hyperparameters for PGD-AT: (Gowal et al.) 2020) explore the limits of adversarial training CIFAR-10. In this paper, we focus on FGSM-AL AT, which computationally cheap but has severe overfitting issue, and propose bag of tricks to fix it.
Catastrophic overfitting. (Wong et 2020) find, for FGSM-AT, its robust accuracy against PGD attacker will drop to zero after several training epochs. naming this phenomenon as catastrophic overfitting. (Rice al. 2020) argue that catastrophic overfitting is a special case that only exists in FGSM-AT; moreover, they identify the key reason is that a weak adversarial attacker (e.g., FGSM) used training. (Kim al., (202T) find the decision boundary distortion closely related the catastrophic overfitting, and further propose to apply various step sizes for each image to address this issue. this paper, rather than modifying adversarial attackers, we show that pure FGSM can enable robust learners.
CONCLUSION
This work studies the solutions to the catastrophic overfitting problem in FGSM-AT from three different perspectives: Data Initialization, Network Structure, and Optimization. Comprehensive results multiple robustness settings demonstrate that the proposed methods effectively stabilize FGSM-AT. We hope this study could encourage the community to rethink the value of FGSM-AT and potentially contribute elegant version of fully stabilized FGSM-AT in the future.

---

Under review as a conference paper at ICLR 2023
REFERENCES
Maksym Andriushchenko and Nicolas Flammarion. Understanding and improving fast adversarial training. In NeurIPS, 2020.
Maksym Andriushchenko, Francesco Croce, Nicolas Flammarion, and Matthias Hein. Square attack: a query-efficient black-box adversarial attack via random search. In ECCV, 2020.
Yutong Bai, Jieru Mei, Alan Loddon Yuille, and Cihang Xie. Are transformers more robust than cnns? In NeurIPS, 2021.
Zachary Berger, Parth Agrawal, Tian Yu Liu, Stefano Soatto, and Alex Wong. Stereoscopic universal perturbations across different architectures and datasets. In CVPR, 2022.
J. Chen, Yu Cheng, Zhe Gan, Quanquan Gu, and Jingjing Liu. Efficient robust training via backward smoothing. In AAAI, 2022.
Djork-Aré Clevert Thomas Unterthiner, and Sepp Hochreiter. Fast and accurate deep network learning by exponential linear units (elus). In ICLR, 2016.
Francesco Croce and Matthias Hein. Minimally distorted adversarial examples with a fast adaptive boundary attack. In ICML, 2020a.
Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free free attacks. In ICMI, 2020b.
Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, Jakob Uszkoreit, and Neil Houlsby. An image is worth 16x 16 words: Transformers for image recognition at scale. In ICLR, 2021.
Ian Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In ICLR, 2015.
Sven Gowal, Chongli Qin, Jonathan Uesato, Timothy A. Mann, and Pushmeet Kohli. Uncovering the limits of adversarial training against norm-bounded adversarial examples, ArXiv, abs/2010.03593,
2020.
Sven Gowal, Sylvestre-Alvise Rebuffi, Olivia Wiles, Florian Stimberg, Dan Andrei Calian, and Timothy Mann. Improving robustness using generated data. In NeurlPS, 2021.
Minghao Guo, Yuzhe Yang, Rui Xu, Ziwei Liu, and Dahua Lin. When nas meets robustness: In search of robust architectures against adversarial attacks. In CVPR, 2020.
Ali Hassani, Steven Walton, Nikhil Shah, Abulikemu Abuduweili. Jiachen Li, and Humphrey Shi. Escaping the big data paradigm with compact transformers. ArXiv, abss2204.05504,, 2021.
Kaiming He, X. Zhang. Shaoqing Ren, and Jian Sun. Identity mappings in deep residual networks. In ECCV, 2016.
Dan Hendrycks and Kevin Gimpel. Gaussian error linear units (gelus), arXiv: Learning, 2016.
Harini Kannan, Alexey Kurakin, and Ian J. Goodfellow. Adversarial logit pairing. ArXiv, abs/1803.06373, 2018.
Hoki Kim, Woojin Lee, and Jaewook Lee. Understanding catastrophic overfitting in single-step adversarial training. In AAAI, 2021.
A. Krizhevsky and G. Hinton. Learning multiple layers of features from tiny images. Handbook of Systemic Autoimmune Diseases, 1(4), 2009.
Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial machine learning scale. In ICLR, 2017.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant adversarial attacks. In ICLR, 2018.
10

---

Under review as a conference paper at ICLR 2023
Vinod Nair and Geoffrey E. Hinton. Rectified linear units improve restricted boltzmann machines. In ICML, 2010.
Tianyu Pang, Xiao Yang, Yinpeng Dong, Hang Su, and Jun Zhu. Bag of tricks for adversarial training. In ICLR, 2021.
Sayak Paul and Pin- Yu Chen. Vision transformers are robust learners. In AAAI, 2022.
Prajit Ramachandran, Barret Zoph, and Quoe Le. Searching for activation functions. ArXiv, abs/1710.05941, 2018.
Sylvestre-Alvis Rebuffi, Sven Gowal, Dan Andrei Calian, Florian Stimberg, Olivia Wiles, and Timothy Mann. Data augmentation can improve robustness. In NeurlPS, 2021.
Leslie Rice, Eric Wong, and J. Zico Kolter. Overfitting in adversarially robust deep learning. In ICML, 2020.
Vikash Sehwag, Saeed Mahloujifar, Tinashe Handina, Sihui Dai, Chong Xiang, Mung Chiang, and Prateek Mittal. Robust learning meets generative models: Can proxy distributions improve adversarial robustness? In ICLR, 2022.
Ali Shafahi, Mahyar Najibi, Amin Ghiasi, Zheng Xu,John John P. Dickerson, Christoph Studer, Larry S. Davis, Gavin Taylor, and Tom Goldstein. Adversarial training for free! In NeurIPS, 2019.
Rulin Shao, Zhouxing Shi, Jinfeng Yi, Pin- Yu Chen, and Cho-Jui Hsich. On the adversarial robustness of vision transformers. ArXiv, 0tbs/2103.156777 2021.
Vasu Singla, Sahil Singla, David Jacobs, and Soheil Feizi. Low curvature activations reduce overfitting in adversarial training. In /CCV, 2021.
Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. In ICLR, 2014.
Shiyu Tang, Ruihao Gong, Yan Wang, Aishan Liu, Jiakai Wang, Xinyun Chen, Fengwei Yu, Xian- glong Liu, Dawn Song, Alan Yuille, et al. Robustart: Benchmarking robustness on architecture design and training techniques. arXiv preprint arXiv:2119.05211, 2021.
Florian Tramèr, Alexey Kurakin, Nicolas Papernot, Ian Goodfellow, Dan Boneh, and Patrick Mc- Daniel. Ensemble adversarial training: Attacks and defenses. In ICLR, 2018.
Eric Wong, Leslie Rice, and J. Zico Kolter. Fast is better than free: Revisiting adversarial training. In ICLR, 2020.
Boxi Wu, Jinghui Chen, Deng Cai, Xiaofei He, and Quanquan Gu. Do wider neural networks really help adversarial robustness? NeurlPS, 2021.
Cihang Xie, Yuxin Wu, Laurens van der Maaten, Alan Yuille, and Kaiming He. Feature denoising for improving adversarial robustness. In CVPR, 2019.
Cihang Xie, Mingxing Tan, Boqing Gong. Alan Loddon Yuille, and Quoc V. Le. Smooth adversarial training. ArXiv, abs/2006. 145326 2020.
Hongyang R. Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael I. Jordan. Theoretically principled trade-off between robustness and accuracy. In ICML, 2019.


Reviews:
[{"review_id": "v44CU0ycvua", "reviewer": "Reviewer_sP57", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper comprehensively study how to mitigate or get rid of catastrophic overfitting from perspectives: data initialisation, network architecture and optimisation, and thus provides a bag of tricks for how to improve and stabilise fast adversarial training.\nSpecifically, the authors find that randomly masking out some input features, using smooth activation functions, increase the convolutional strides and regularising the weights on the first convolutional layer can help.", "summary_of_the_review": "This paper empirically study the tricks to improve fast adversarial training.\nAlthough it can provide some useful tricks for practitioner, the paper still does not reach the bar of publishing because of the concerns above.\n\nI suggest the authors provide more analyses, explanations and intuitions, as well as the open-source code to make the findings of this paper more convincing.", "strength_and_weaknesses": "Strength:\n\n1. Some observations, such as random masking and increased convolutional strides, are interesting and could be useful for practitioners. \n2. Many experiments and ablation study are conducted to support the authors' claims.\n\nWeakness:\n\n1. My major concern is the novelty, the contribution is actually incremental. This is a pure empirical work, and the authors provide almost no explanation or intuitions about why these tricks work. This makes me doubt if these technique can be applied to more complicated tasks, such as ImageNet.\n\n2. Although the tricks proposed can get rid of catastrophic overfitting, but the final results are not very competitive. For example, on the robustBench, \"Efficient Robust Training via Backward Smoothing\" can achieve 51.12% and 26.94% robust accuracy under AA on CIFAR10 and CIFAR100, respectively.\n\n3. In order to achieve the best results, the authors should apply combinations of several tricks on WideResNet-34-10 as well, since the result of a single trick on WideResNet-34-10 is still worse than when we apply several to PreActResNet-18.\n\n4. As mentioned in the beginning of Section 3, the authors do not use the label smoothing. What is the reason behind this? As fas as I know, adaptive label like the one in self adaptive training (https://proceedings.neurips.cc/paper/2020/file/e0ab531ec312161511493b002f9be2ee-Paper.pdf) can indeed improve the performance with little overhead.\n\nMinor:\n\n1. Variance should be reported for Table 2.\n\n2. More values of $\\alpha$ should be included in Figure 5(b).\n\n\n\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "1: The contributions are neither significant nor novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "nfnjTXDFB0r", "reviewer": "Reviewer_LqK6", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper systematically studies different tricks for FGSM adversarial training (FGSM-AT) on CIFAR-10/100. They found that there are three simple tricks that overcome the catastrophic overfitting in FGSM-AT: Data Initialization, Network Structure, and Optimization.", "summary_of_the_review": "This paper systematically studies different tricks for FGSM-AT, but its main target is to overcome the catastrophic overfitting. If the authors consider doing a topic on ''bags of tricks,\" I think the authors should give more takeaways and put forward a standard baseline setting for future work. I have many concerns about the current version. For more details, please refer to the [Strength And Weaknesses].", "strength_and_weaknesses": "I think this work is a valuable contribution to the research on FGSM adversarial training, but I have a few concerns regarding of the current version.\n\n1. I think there is a slight discrepancy between the title and the core idea of the paper. Throughout the whole paper, the first glance of three tricks is to overcome catastrophic overfitting in FGSM-AT. Their improvement in performance is not very noticeable. Moreover, I think if the title is ``bags of tricks``, the studies of hyperparameter and other perspectives are also considered. Maybe the title like ``three things everyone should know ...`` is better. \n\n2. In Figure 2, the authors show the results by using a masking trick. When mask ration is equal to 30%, why does the training experience catastrophic overfilling after the first learning rate drops? My concern for the Mask-Fixed scheme is whether the result is related to random initialization. For instance, we just achieved a good random mask that is beneficial to FGSM-AT. So I think it's better to run the experiments multiple times and report the mean and variance score. Masking techniques are similar to random erasing [1] and cutout [2]. How well does it work using this classic data regularization technique?\n\n3. In section 3.2, they studied the impact of the network structure. Some related work is missing. In [3], the authors \"modernize\" a standard ResNet toward the design of a vision transformer, which shows promising robustness behaviors. And the work in [4] uses the NAS technique with different modules to improve the model's robustness.\n\n4. The stride of CNN is actually related to the spatial downsampling. Recently, DiffStride [5] is a pooling layer with learnable strides. I suggest the authors try this adaptive module. Moreover, I think this modification of strides is linked to the frequency model in [6], which also modified the first layer in CNN. Moreover, I am interested in the impact of the large kernel used in recent CNN [3, 7].\n\n5. I think it's better to report the training time in all experiments, especially for the tables.\n\n6. In Table 5, what will the results be when we combine multiple tricks? For example, we consider: Mask-fixed+Str2 (+Weightnorm), and Mask+Smooth+WeightNorm. A similar question is also for Table 6. What will the results be when considering Smooth+Str2, mask+smooth, and Smooth+Str2+WeightNorm?\n\n7. In Table 7 and Figure 8, it's better to show the results of a combination of different tricks.\n\n8. A recent FGSM-AT [8] is missing.\n\n9. FGSM-AT is an effective adversarial training that can train deep model on large-scale dataset, like ImageNet. So it's better to evaluate the mentioned tricks on a large dataset, like Tiny-ImageNet or ImageNet. \n\n[1] Random Erasing Data Augmentation. AAAI 2020.\n\n[2] Improved Regularization of Convolutional Neural Networks with Cutout. Arxiv 2017.\n\n[3] A ConvNet for the 2020s, CVPR 2022.\n\n[4] Anti-Bandit Neural Architecture Search for Model Defense. ECCV 2020.\n\n[5] DiffStride: Learning strides in convolutional neural networks. ICLR 2022. \n\n[6] High-frequency component helps explain the generalization of convolutional neural networks. CVPR 2020.\n\n[7] Scaling up your kernels to 31x31: Revisiting large kernel design in cnns. CVPR 2022.\n\n[8] Revisiting and advancing fast adversarial training through the lens of bi-level optimization. ICML 2022.", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "4: The contributions are significant, and do not exist in prior works."}, "extra_text": {}}, {"review_id": "g3sOuR91R2c", "reviewer": "Reviewer_8ACT", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "As the title suggests, this work studies bags of tricks for FGSM AT.\n", "summary_of_the_review": "Overall, I believe this work has some strong empirical findings but lacks a good explanation of why they help prevent catastrophic overfitting. The limited technical contribution might also be a concern. I decide to submit this late review considering it only has three reviews, however, the authors do not need to address my concerns considering that my review is late. \n\nEven though my score is 5 (marginally below the acceptance threshold), I am totally okay if this paper is accepted. \n", "strength_and_weaknesses": "Strength 1: This work performs a comprehensive analysis on FGSM AT\n\nStrength 2: Competitive performance.\n\nWeakness1: The main concern is that this work mainly relies on empirical results on showing effectiveness. For example, it is fully unclear why masking a subset of the input pixels can stabilize FGSM-AT. Why does it help prevent catastrophic overfitting? Why does catastrophic overfitting happen to ViT not CNN? Why does larger stride help? To my understanding, the core issue in FGSM AT its how to prevent catastrophic overfitting, a recent work [1] shows random noise augmentation is sufficient for preventing catastrophic overfitting and the reason of its success is analyzed in another work [2]. Can Non-robust feature perspective in [2] be used to explain to the success of the proposed techniques in this work? Or do the authors have their own new perspective? From my understanding, to provide explanations for why the techniques can be more important than the tricks themselves, especially in the adversarial ML community. Otherwise, the takeaway from this work can be limited. \n\nWeakness2: The technical contributions might also be limited.\n\n\n[1] Fast Adversarial Training with Noise Augmentation: A Unified Perspective on RandStart and GradAlign, https://arxiv.org/pdf/2202.05488.pdf\n\n[2] Understanding Catastrophic Overfitting in Fast Adversarial Training From a Non-robust Feature Perspective, https://openreview.net/forum?id=UO8UP_xDMwD", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "QYXJikFRew0", "reviewer": "Reviewer_sPmb", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "In this work, the authors study the phenomenon of catastrophic failure during Fast Gradient Sign Method (FGSM) adversarial training, and identify a collection of techniques that help stabilize the training process. In particular, the paper proposes three main ingredients: (1) modifying data wherein a random/fixed subset of input pixels are masked to zero, (2) the use of larger strides for convolutions and smooth activation functions, and (3) regularization of weights or gradients. ", "summary_of_the_review": "Though the technical contributions are limited, the paper presents a fairly simple set of modifications to Fast-FGSM-AT with minimal computational overhead. The overarching guidelines, such as using a larger stride for convolutions etc are useful in practice, and is a good contribution overall. As mentioned in the weaknesses, results over a larger number of seeds could be presented to better establish the generality and validity of results, alongside a more detailed discussion for pertinent sections such as the results obtained on WideResNet, larger perturbation radii etc. I would be willing to raise my score further if these issues could be addressed.", "strength_and_weaknesses": "Strengths:\n1) The paper is well-written, and motivates each aspect considered in a clear manner. \n2) The three primary modifications identified are seen to be fairly effective in stabilizing FGSM-based adversarial training, while not requiring any large additions in the computational footprint needed for training.\n3) Moreover, the methods themselves, such as masking out a fraction of the input pixels, or using larger stride for convolutions and smooth activation functions are fairly simple, and thus will likely be quite of high utility in practice.\n4) The paper also presents a fairly thorough ablative study to better understand the relative contribution of these different techniques. In particular, the results obtained on the WideResNet-34-10 indicate that the findings are not overly specific to one network-type alone, and yield robust networks in sharp contrast to that of Fast-FGSM-AT.\n5) In addition, the results presented over larger perturbation radii also help establish the validity and generality of the techniques proposed to mitigate catastrophic failure during FGSM training, and are seen to be effective even at 16/255 for L-infinity based adversaries. \n\n\n\nWeaknesses:\n1) The paper slightly lacks from the viewpoint of technical novelty, but the empirical findings presented are still useful for the community at large. For example, the notion of using a fixed mask to help stabilize training seems to suggest that reducing the dimensionality of the input is effective, and this might correlate well with the “effective” strength of an L-infinity based adversary in being able to perturb fewer pixels, though the epsilon-budget stays fixed.  \n2) Moreover, the paper could have been significantly improved by including discussions on the L2 threat model with FGSM-AT, to yield a better understanding of the techniques, and the extent of their generality.\n3) Given that the main theme of the paper is about improving the stability of single-step FGSM training, a more comprehensive experiment set would be expected over a large statistical sample - the average over three random seeds alone is perhaps a bit lacking. Given that the models can be trained extremely quickly, the paper could perhaps have shown results over 10 random seeds, given that even FGSM-AT behaves quite differently at times with different initializations. This certainly is not required for all the different values presented in all the tables, but could have been included for final comparisons.\n4) The ablation with WideResNet-34-10 is a fairly pertinent section of the paper, since it presents an important leap in stability over Fast-AT. For example, were these models too trained for 110 epochs similar to that of results present for the ResNet models, alongside other factors such as learning rate? Other observations from Table-6, such as that of the stride being set to 2 appearing to be the single-most effective factor could have been discussed in more detail, and is fairly important to assess the relative importance amongst other proposed ingredient changes.\n5) Furthermore, since robust overfitting is observed at a much larger scale in these settings, validation-based early stopping might help present potential improvements as well, and would better set apart the improvements achieved over Fast-AT which uses early stopping necessarily. Similarly, more detailed comparisons could have been made with respect to GradAlign in Figure-8 with larger perturbation radii for the L-infinity threat model. Overall, the contributions of the paper can perhaps be strengthened significantly by including a more detailed and broadened discussion of the ablations section, with other matter potentially moved to the appendix.\n6) Could the authors also comment on the low clean accuracy achieved by several models that utilize the smooth activation function, such as those presented in Table-3,6? Since the tradeoff between robustness and accuracy is well known, focusing on robust accuracy in a vacuum may not be entirely indicative of the phenomenon at hand. For example, is it believed that these networks overfit to a far smaller extent, and have consequent impacts on the level of robustness proportionately achieved?\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}]

Author rebuttal:

Decision: Reject