Strength-Adaptive Adversarial Training
Authors: Chaojian Yu
Dawei Zhou
Li Shen
Jun Yu
Bo Han
Mingming Gong
Nannan Wang
Tongliang Liu
Venue: Submitted to ICLR 2023 (2023)

Abstract: Adversarial training (AT) is proved to reliably improve network's robustness against adversarial data. However, current AT with a pre-specified perturbation budget has limitations in learning a robust network. Firstly, applying a pre-specified perturbation budget on networks of various model capacities will yield divergent degree of robustness disparity between natural and robust accuracies, which deviates from robust network's desideratum. Secondly, the attack strength of adversarial training data constrained by the pre-specified perturbation budget fails to upgrade as the growth of network robustness, which leads to robust overfitting and further degrades the adversarial robustness. To overcome these limitations, we propose Strength-Adaptive Adversarial Training (SAAT). Specifically, the adversary employs an adversarial loss constraint to generate adversarial training data. Under this constraint, the perturbation budget will be adaptively adjusted according to the training state of adversarial data, which can effectively avoid robust overfitting. Besides, SAAT explicitly constrains the attack strength of training data through the adversarial loss, which manipulates model capacity scheduling during training, and thereby can flexibly control the degree of robustness disparity and adjust the tradeoff between natural accuracy and robustness. Extensive experiments show that our proposal boosts the robustness of adversarial training. 

Under review as a conference paper at ICLR 2023
STRENGTH-ADAPTIVE ADVERSARIAL TRAINING
Anonymous authors
Paper under double-blind review
ABSTRACT
Adversarial training (AT) is proved to reliably improve network's robustness against adversarial data. However, current AT with pre-specified perturbation budget has limitations in learning a robust network. Firstly, applying pre- specified perturbation budget on networks of various model capacities will yield divergent degree of robustness disparity between natural and robust accuracies, which deviates from robust network's 's desideratum. Secondly, the attack strength of adversarial training data constrained by the pre-specified perturbation budget fails to upgrade as the growth of network robustness, which leads to robust over- fitting and further degrades the adversarial robustness. To overcome these limita- tions, we propose ttrength-Aappivc Adversarial Training (SAAT). Specifically, the adversary employs an adversarial loss constraint to generate adversarial train- ing data. Under this constraint, the perturbation budget will be adaptively adjusted according to the training state of adversarial data, which can effectively avoid ro- bust overfitting. Besides, SAAT explicitly constrains the attack strength of training data through the adversarial loss, which manipulates model capacity scheduling during training, and thereby can flexibly control the degree of robustness dispar- ity and adjust the tradeoff between natural accuracy and robustness. Extensive experiments show that our proposal boosts the robustness of adversarial training.
INTRODUCTION
Current deep neural networks (DNNs) achieve impressive breakthroughs on a variety of fields such as computer vision (He er al. 2016). speech recognition (Wang et al.] (017). and NI.P (Devlin et al.] 2018). but is well-known that DNNs are vulnerable to adversarial data: small perturbations of the input which are imperceptible to humans will cause wrong outputs (Szegedy et al. 2013 Goodfellow al. 2014). As countermeasures against adversarial data, adversarial training (AT) is a method for hardening networks against adversarial attacks (Madry et al. 2017). AT trains the network using adversarial data that are constrained by a pre-specified perturbation budget, which aims to obtain the output network with the minimum adversarial risk of an sample to be wrongly classified under the same perturbation budget. Across existing defense techniques, AT has been proved to be one of the most effective and reliable methods against adversarial attacks (Athalye et al. 2018).
Although promising to improve the network's robustness, AT with a pre-specified perturbation bud- get still has limitations in learning a robust network. Firstly, the pre-specified perturbation budget is inadaptable for networks of various model capacities, yielding divergent degree of robustness dis- parity between natural and robust accuracies, which deviates from robust network's 's desideratum. Ideally, for a robust network, perturbing the attack budget within a small range should not cause signifcant accuracy degradation. Unfortunately, the degree of robustness disparity is intractable for AT with a pre-specified perturbation budget. In standard AT, there could be prominent degree of PreAct
robustness disparity in output networks. For instance. standard PGD ddverssriaall-traine ResNet18 network has 84% natural accuracy and only 46% robust accuracy on CIFARIO under foc threat model, as shown Figure Ta). Empirically, we have to increase the pre-specified perturba- tion budget to allocate more model capacity for defense against adversarial attacks to mitigate the degree of robustness disparity, as shown in Figure However, the feasible range of perturbation budget is different for networks with different model capacities. For example, AT with perturbation budget e = 40/255 will make PreAct ResNet-18 18 optimization collapse, while wide ResNet-34- 10 can learn normally. In order maintain steady degree of robustness disparity. we have to find separate perturbation budgets for each network with different model capacities. Therefore, it may be pessimistic to use AT with a pre-specified perturbation budget to learn a robust network.

---

Under review as a conference paper at ICLR 2023
2
(N2M)
(a)
(b)
(C)
Figure I: Robustness evaluation on different test perturbation budgets of (a) standard AT; (b) AT with different training pre-specified perturbation budgets. with pre-specified perturbation e = 8/255 on PreAct ResNet-18 under foo threat model and the robustness evaluation of its "best" and "last" checkpoints.
(c) The learning curve of standard AT
Secondly, the attack strength of adversarial training data constrained by the pre-specified pertur- bation budget is gradually weakened as the growth of network robustness. During the training process, adversarial training data are generated on the fly and are changed based on the updating of the network. As the the network's 's adversarial robustness continues to increase, the attack strength of adversarial training data with the pre-specified perturbation budget is getting relatively weaker. Given the limited network capacity, degenerate or stagmant adversary accompanied by an evolving network will easily cause training bias: adversarial training is more inclined to the defense against weak strength attacks, and thereby erodes defenses on strong strength attacks, leading to the unde- sirable robust overfitting, as shown in Figure [e.. Moreover, compared with the "best" checkpoint in AT with robust overfitting, the "last" checkpoint's defense advantage in weak strength attack is slight, while its defense disadvantage in strong strength attack is significant, which indicates that robust overfitting not only exacerbates the degree of robustness disparity, but also further degrades the adversarial robustness. Thus, may be deficient to adversarial data with a pre-specified perturbation budget to train a robust network.
To overcome these limitations, we propose strength-adaptive adversarial training (SAAT), which employs an adversarial loss constraint to generate adversarial training data. The adversarial pertur- bation generated under this constraint adaptive to the dynamic training schedule and networks of various model capacities. Specifically, as adversarial training progresses, larger perturbation budget is required to satisfy the adversarial loss constraint since the network becomes more robust. Thus, the perturbation budgets in our SAAT is adaptively adjusted according to the training state of adversarial data, which restrains the training bias and effectively avoids robust overfitting. Besides, SAAT explicitly constrains the attack strength of training data by the adversarial loss constraint, which guides model capacity scheduling in adversarial training, and thereby can flexibly adjust the tradeoff between natural accuracy and robustness, ensuring that the output network maintains steady degree of robustness disparity even under networks with different model capacities.
Our contributions with a pre-specified perturbation budget, which is due to the intractable robustness disparity and undesirable robust overfitting (in Section 3.1. (b) We propose a new adversarial training method, i.e., SAAT (its learning objective in Section 3.2 and its realization in Section (.3). SAAT is
follows. (a) In standard AT, we characterize the pessimism of adversary
general adversarial training method that can be easily converted natural training or standard AT. (c) Empirically, we find that adversarial training loss is well-correlated with the degree of robustness disparity and robust generalization gap (in Section 4.2), which enables our SAAT to overcome the issue of robust overfitting and flexibly adjust the tradeoff of adversarial training, leading to the improved natural accuracy and robustness (in Section
PRELIMINARY AND RELATED WORK
In this section, we review the adversarial training method and related works.
2.1 ADVERSARIAL TRAINING
Learning objective. Let fe. X' and l be the network with trainable model parameter 6, input feature space, and loss function, respectively. Given a C-class dataset S = {(,,, y:) y:) where
I, X and y/ E y {0, 1,.... C. -11 as its associated label. In natural training, most machine
2

---

Under review as a conference paper at ICLR 2023
leamning tasks could be formulated as solving the following optimization problem:
min ((fo(xs)
The learning objectíve of natural training is to obtain the networks that have the minimum empirical risk of natural input be wrongly classified. In adversarial training, the adversary adds the adversarial perturbation to each sample, i.e., transform S = ((r, y)) to S' = {(01 x, + d. }=)=== The adversarial perturbation {6:]== are constrained by a pre-specified budget, i.e. {ō A ||0||p S e}. where p can be 1, 2, 0o, etc. In order to defend such attack. standard adversarial training (AT) (Madry al. (017)) resort to solve the following objective function:
min 0
max (fo(a; + +6)) 91).
ME
Note that the outer minimization remains the same as Eq. I1, and the inner maximization operator can also be re-written as
8; arg max ((fo (3; 6.), 34),
where 2/ = x; + 6; is the most adversarial data within the perturbation budget A. Standard AT employs the most adversarial data generated according to Eq.3) for updating the current model. The learning objective of standard AT to obtain the networks that have the minimum adversarial risk of a imput to be wrongly classified under the pre-specified perturbation budget.
Realizations. The objective functions of standard AT (Eq, 2 is a composition of an inner maxi- mization problem and an outer minimization problem, with one step generating adversarial data and one step minimizing loss on the generated adversarial data w.r.t. the model parameters 6. For the outer minimization problem, Stochastic Gradient Descent (SGD) (Bottou 1999) and its variants are widely used to optimize the model parameters (Rice al. 2020). For the inner maximization prob- lem, the Projected Gradient Descent (PGD) (Madry et al. 2017) is the most common approximation method for generating adversarial perturbation, which can be viewed as multi-step variant of Fast Gradient Sign Method (FGSM) (Goodfellow et al. 2014). Given normal example E X and step size a > 0, PGD works as follows:
g++1 aa signV + ), +
(4)
where 8 is adversarial perturbation at step k; and IIA is the projection function that project the adversarial perturbation back into the pre-specified budget A if necessary.
2.2 RELATED WORK
Stopping criteria. There are different stopping criteria for PGD-based adversarial training. For example, standard AT (Madry al. (017) employs fixed number of iterations K. namely PGD-K, which is commonly used in many outstanding adversarial training variants, such as TRADES (Zhang let al. 2019). MART (Wang et al. 2019h), and RST (Carmon al. 2019). Besides, some works have further enhanced the PGID-K method by incorporating additional optimization mechanisms, such curriculum learning (Cai al., 2018)). FOSC (Wang et al., 2019a), and geometry reweight- ing (Zhang et al. 2020b). On the other hand, some works adopt different PGD stopping criterion, i.e., misclassiiiattonnaaarr criterion, which stops the iterations once the network misclassifies the adversarial data. This misclassificationnann -asasaaaiicttiinaaaaaaeee aware criterion is widely used in the emerging adversarial training variants, such as FAT (Zhang et al. (2200)), MMA (Ding al. 2018). IAAT (Balaji al., 2019), ATES (Sitawarin et al. 2020). and Customized AT (Cheng et al. 2020). Different from these works, we propose
adaptive PGD (SA-PGD) that uses the minimum adversarial loss as the stopping criterion to generate efficient adversarial data for adversarial training.
Relationship between accuracy and robustness. Also relevant to this work are works that study the relationship between natural accuracy and robustness. PGD-based AT can enhance the robustness against adversarial data, but degrades the accuracy on the natural data significantly. One popular point is the inevitable tradeoff between robustness and natural accuracy. For example, Tsipras et al. (2018) claimed robustness and natural accuracy might at odds. [Su et al. (2018) concluded a lin- early negative correlation between the logarithm of natural accuracy and robustness. /Zhag et al.
3

---

Under review as a conference paper at ICLR 2023
2019) theoretically characterized the tradeoff. However, human is a network that is both robust and accurate with no tradeoff according to the definition of adversarial perturbation. Some other works also provide evidence that robustness and natural accuracy are not opposing. For example, Stutz et al. (019) confirmed the existence of adversarial data on the manifold of natural data. Yang distributionally separated. Raghunathan et al. (2020) stated that additional unlabeled data help mitigate the tradcoff. Nakki- ran (2019) proved that the tradeoff' is due to the insufficient network expression ability. A separate but related line of works also has challenged the tradeoff by improving the natural accuracy while maintaining the robustness (Zhang al., (020a) or retaining the natural accuracy while improving the robustness (Zhang et al.) 2020b). However, these works use PGD as the robustness evaluation. which is not always successful since these networks can defeated by stronger attacks (Liu et al.) 202T]. In this work, we combine Auto-Attack (Croce & Hein (2020)) stronger and more reliable robustness evaluation method, to conduct a more comprehensive evaluation of AT's tradeoff.
et al. (2020) showed benchmark datasets with adversarial perturbation
3 STRENGTH-ADAPTIVE ADVERSARIAL TRAINING
In this section, we introduce the proposed strength-adaptive adversarial training (SAAT) and its learning objective well algorithmic realization.
3.1 MOTIVATIONS OF SAAT
Robustness disparity is intractable for AT with pre-specified perturbation budget. For adversarially-traine networks, it is widely recognized that robust accuracy should be lower than the natural accuracy. Nevertheless, the degree of robustness disparity between natural and robust accuracy is often overlooked. Ideally, for a fully robust network, the robust accuracy and natural accuracy should be very close. The technique of maintaining a steady degree of robustness disparity is therefore critical for learning a robust network. However, current AT methods typically employ a pre-specified perturbation budget to generate adversarial data, whose attack strength relative to the network's 's model capacity, which fails to yield steady degree of robustness disparity across dif- ferent networks, as shown Figure 2 a). For each network, we further numerically compute their degree of robustness disparity (RD): RD n Σi= Ao-As, where A, represents the accuracy on the perturbation budget e, As shown by the statistical results in Figure bb), when the perturbation budget is fixed, the degree of robustness disparity becomes more prominent the model capacity increases, which is not robust network's desideratum. Thus, to maintain steady degree of robust- ness disparity in adversarial training, we should open up perturbation budget constraints and flexibly adjust the attack strength of training data according to the network's model capacity.
Robust overfitting degrades the network's 's adversarial robustness. AT employs the most adver- sarial data to reduce the sensitivity of the network's 's output w.r.t adversarial perturbation of the natural data. However, during the training process, adversarial training data is generated on the fly and is getting weaker for networks with increasing adversarial robustness. Given a certain amount of allocatable model capacity, the adversarial training data with a pre-specified perturbation budget will inevitably induce training bias, which eventually leads to the robust overfitting, As shown in Figure c(.), it is observed that when the perturbation budget is fixed, robust overfitting occurs as the network's 's model capacity increases. We further compare the adversarial robustness between the "best" and "last" checkpoints in AT without robust overfitting and with robust overfitting. As shown in Figure d)) it can be seen that robust overfitting sigmificantly degrades the network's 's adversarial robustness. Therefore, to avoid robust overfitting adversarial training, we should flexibly adjust the attack strength of adversarial training data to adapt to the dynamic training schedule.
3.2 LEARNING ORJECTIVE OF SAAT
Let be the specified minimum adversarial loss constraint to adversarial training data. In the learn- ing objective of SAAT, the outer minimization for optimizing model parameters still follows Eq. or [.). However, instead of generating adversarial perturbation 8 via inner maximization, we generate 8 as follows:
5, arg min E(So(r + 5.), vi) s.t. e(So(r + 8.). 2 p.
(5)
4

---

Under review as a conference paper at ICLR 2023
Tpuch WIN 12.
W83.3-7
1.0%
(a)
(b)
(c)
(d)
Figure 2: (a) Robustness evaluation, (b) robustness disparity and (c) testing curves of AT with perturbation budget 8/255 under foe threat model on networks with different model capacities; (d) robustness differences between the "best" and "last" checkpoints in AT without robust overfitting (WRN-34-I) and with robust overfitting (WRN-34-7).
Note that the operator arg max in (3) is replaced with arg min here, and there is no explicit perturbation budget constraint for 8. Instead, we adopt the magnitude of adversarial loss to constrain the generation of adversarial perturbation. The constraint ensures that the loss of adversarial training data is greater than the specified minimum adversarial loss Among all such 8 satisfying the constraint, we select the one minimizing [ff( + 9:). In terms of the process of generating adversarial perturbations, (5. could be regarded as an adaptive adversary, since adversarial loss related to the training schedule and network's model capacity. For example, in the early stages of training, adversarial attack may be needless to generate qualified adversarial training data. However, the later stages of training, more effort is required to generate the corresponding adversarial training data because the network is more robust. On the other hand, in terms of attack strength of training data, (5 is actually an attack strength- adversary, since the adversarial loss of training data constrained by fixed p.
The learning objective of SAAT is to obtain the networks with a steady degree of robustness dis- parity, which is achieved by optimizing model using adversarial training data with fixed attack strength (in terms of the adversarial loss p). is used to guide model capacity scheduling during adversarial training. as ensure that the output network maintains steady degree of robustness disparity.
Relation with natural training and standard AT. Notice that the learning objective of SAAT is extremely general. When p S 0, SAAT is equivalent to natural training (refer to [q. then all training data does not need adversarial perturbations, used to learn natural data. When p - 20, SAAT is equivalent to standard AT (refer to Eq.(). then all training data is the most adversarial data, so that large amount of model capacity will be used for enhancing adversarial robustness (depending
that most of the model capacity will be
the maximal perturbation budget). When < P < 0o, SAAT lies in the middle of natural training and standard AT, which can manipulate the model capacity scheduling during the training phase, so obtain the output network with multiple alternative forms of adversarial robustness for various practical needs. (5. recovers both natural training and standard AT, thus it is more general learning objective of adversarial training.
3.3 REALIZATION OF SAAT
The learning objective of SAAT implies the optimization of an adversarially robust networks with a steady degree of robustness disparity, with one step generating qualified adversarial training data and one step minimizing the adversarial loss w.r.t. the model parameters. Specifically, we search for qualified adversarial training data by adjusting the perturbation budget and attack step. For instance, given perturbation budget, we perform sufficient PGD attacks within this budget. the most adversarial data still does not satisfy the constraint of 55, we will increase the perturbation budget and conduct further PGD attacks until we find adversarial data that satisfies the minimum adversarial loss criterion.
How to estimate the optimal perturbation budget is an open question. Here we heuristically design simple implementation: progressive search. Specifically, the perturbation budgets of training data are initially set to O, and then their perturbation budgets are increased stepwise (e.g.. increments of step size 7). Each time the perturbation budgets are updated, it is followed by K iterations of PGD attacks until the generated adversarial data satisfies the minimum adversarial loss criterion. The limitation of this implementation is that setting the initial perturbation budget O increases the
5

---

Under review as a conference paper at ICLR 2023
Algorithm Strength-Adaptive PGD (SA-PGD)
1: Input: data X, label y y. model loss function L, maximum perturbation budget Cruazs minimum
adversarial loss p. perturbation budget 6, perturbation budget step size т, SA-PGD step K, SA-PGD step size
2: Output: x'
3: x' < -i 0
4: if ((f(x'),v) 2 p then
break
6: else
7:
while < Emon do
8:
6 T
for k 1, 1,,., K
10:
x' +- Illaa sign(V +x)
11:
if (f(((=')) 2 then
12:
return x end end for
13:
15:
end while
16:
end if
Algorithm 2 Strength
Strength-Adaptive Adaptive Adversarial Training (SAAT)
Input: network fo, training dataset S [(Ire, yo)) learning rate 7) number of epochs T, batch size
m. number of batches M
2: Output: adversarially robust network fa with a target degree of robustness disparity
3: for epoch 1.... 1' do
4: for mini-batch 1, ..., M do
Sample mini-hatch ((ri, 31) y:) from 6: for = 1, ..., m (in parallel) do
7: Obtain adversarial data x of by Algorithm
8: end for
4- " E. Vol((o(1)).
10: end for
11:
end for
computational cost and slows the speed, even though it ensures that the optimal perturbation budget will be estimated.
maximally allowed perturbation budget (Cmar) is introduced: we observe that even with the largest perturbation (e.g.. 255 255/255), there still some examples (outliers) that fail sat- isfy the minimum adversarial loss constraint. Considering that the pixel values are strictly sampled in [0, 255/. is necessary introduce maximum perturbation budget to avoid infinite loops.
Algorithm| is our atrength-adaptive PGD method (SA-PGD). which returns the generated adversar- ial training data. Algorithm 2 the proposed strength-adaptive adversarial training (SAAT). SAAT leverages A for obtaining the qualified ad advrsariial data to optimize the model parameters.
4 EXPERIMENTS
In this section, we conduct comprehensive experiments to evaluate the effectiveness of SAAT includ- ing its experimental setup (in (..), algorithm analysis (in Section 4.2p. robustness evaluation (in Section 4.3), and the performance under different model capacities (in Section 4.4
4.1 EXPERIMENTAL SETUP
Our code is implemented on the open source PyTorch framework with a single NVIDIA A100- SXM4-40GB GPU. The code as well related models will be released for public use and veri- fication. We conduct experiments on foo threat model and follow the hyper-parameter setting of Rice et al. (2020) for fair comparison with the state-of-the-art AT methods. For training, the net- work is trained for 200 epochs using SGD with momentum 0.9, weight decay 5 x 10 and an initial learning rate of 0.1. The learning rate is divided by 10 the 100-th and 150-th epoch,

---

Under review as a conference paper at ICLR 2023
spectively. Conventional data augmentation including random crops with 4 pixels of padding and random horizontal flips are applied. For adversary, we use SA-PGD (Algorithm [T) to generate ad- versarial training data. The step size = 2/255 is used following standard PGD (Madry et al. 2017]. We adopt the perturbation budget step size 7 consistent with the SA-PGD step size a such as r = 2/255, and SA-PGD step K = 3, which is to make the adversarial data sufficiently attacked under the updated perturbation budget. For robustness evaluation, the output model is tested under series of adversaries, including natural data, PGD (Madry al.] 2017), and Auto Attack (Croce & Hein 2020b). Among them, natural accuracy and PGD accuracy can intuitively reflect the net- work's robustness disparity. And AA an ensemble of complementary attacks, consisting of three white-box attacks (APGD-CE (Croce & Hein, 2020b), APGD-DLR (Croce & Hein 2020b), and FAB (Croce& & Hein 2020a)) and a black-box attack (Square Attack (Andriushchenko et al. ()020). AA regards networks to be robust only if the model correctly classify adversarial data with all types of attacks, which is among the most reliable evaluation of adversarial robustness to date.
4.2 ANALYSIS OF THE PROPOSED ALGORITHM
We delve into SAAT to investigate its each component, including the role of minimum adversarial loss p and the impact of maximum perturbation budget <maz- All analysis experiments are conducted using PreAct ResNet-18 (He et al. 2016) on CIFARIO dataset (Krizhevsky et al.) 2009).
The role of minimum adversarial loss p. We empirically investigate the role of minimum ad- versarial loss by using different p to generate adversarial training data, where emax is assigned a sufficiently large value, such as Gmaz = 128 /255. The minimum adversarial loss p for SAAT varies from 0 to 2.2, and the evaluation results are summarized in Figure []] (a). It is observed that the model's degree of robustness disparity is well-correlaed with the adversarial training loss p. When = O. there is large performance gap between the natural accuracy and robust accuracy. This performance gap keeps decreasing as p increases. And when 9 = 2.2, the robust accuracy is al- most the same as the natural accuracy. Note that SAAT fails to converge when p 2.2, which might be explained by the fact that robust accuracy should be lower than natural accuracy for any adversarialll-traine trainedd networks. The clear correlation between the minimum training loss and de- gree of robustness disparity enables our SAAT to flexibly control the performance gap in output networks. Moreover, we observed that p is also elosely related the robust generalization gap. The learning cruves of SAAT with different is shown in Figure (c), and their robust generalization gap is summarized in Figure (d). It can be seen that the robust accuracy is always in sync with the natural accuracy during the training phase and there is no significant robustness degradation as in Figure Jc). When p = 1.5, the robust generalization gap is already very small.
The impact of maximum perturbation budget mmaz. We further investigate the impact of intro- duced maximum perturbation budget, by comparing the robustness performance of models trained using different 6maz. Given a fixed p. such as p 1.5, the value of <mer varies from 0 to 128/255, and the evaluation results are summarized in Figure 3 (b). It can be observed that when émaz is small, increasing émau leads to flatter degree of robustness disparity, which indicates that more model capacity is allocated to defend against adversarial attacks. As expected, when Emar is greater than certain value, the degree of robustness disparity begins to maintain plateau, which infers that most of the adversarial training data already met the minimum adversarial loss constraint, so the network tends to maintain steady robustness disparity bound by p. Cmar adjusts the robustness dis- parity within the plateau constrained by p. which reflects a tradeoff between the natural accuracy and adversarial robustness and suggests that our emaz helps adjust this tradeoff. Notably, the observed tradeoff is not inherent in adversarial training but a consequence of model capacity scheduling. Note that the size of Emax is also influenced by minimum adversarial loss p. In the following section, we fine-tune both Emaz and p for the robustness evaluation of SAAT.
4.3 ROBUSTNESS EVALUATION
Compared with the standard AT, the difference of SAAT mainly lies in weakening the easy-to-attack samples (the adversarial loss is higher than the minimal adversarial loss) and enhancing the hard- to-attack samples (the adversarial loss is lower than the minimal adversarial loss). In this part, investigate their respective effects on network adversarial robustness on two classic baselines: AT and AWP, where AWP can suppress robust overfitting and achieve state-of-the-art adversarial robust-
7

---

Under review as a conference paper at ICLR 2023
9.8
2.2
128255
200
40
30
20
10
10
10
12
14
16
18
8
18
12
14
16
15
20
Porturbation bodget (1/255)
budget
(a) Role of minimum adversarial loss
(b) Impact of maximum perturbation budget
Wwww
Nutlma Food
Adternatatint
Learning curves of SAAT with of 0.5, 1.0, 1.5 and 2.0 (from left right)
(pmii))
SSATT Len
948% 124
(d) Robust generalization gap
(e) SAAT under different model capacities
Figure 3: Robustness evaluation of SAAT with (a) varied and (b) varied émar' The (c) learning curve and (d) robust generalization gap with different P; (e) robustness disparity networks with different model capacities.
Specifically, process the easy-to-attack samples and the hard-to-attact samples separately, denoted as SA and SAAT up. respectively. For SAAT the maximum adversarial budget remains the same as the standard AT, e.g., Emaz 8, and the minimal adversarial loss is 1.5. The evaluation results are shown in Table [ As expected, weakening the dasy-to-attace samples will make adversarial training inclined to the weak attack defense, which significantly increase the natural accuracy and can maintain the PGD accuracy, but it essentially not only aggravates the ro- bustness disparity, but also degrades the model adversarial robustness (in term of AA). For SAAT uT by increasing the maximum adversarial budget and minimal adversarial loss, more model capacity used to defend against adversarial attacks, which significantly alleviates the robustness disparity of the output network and further enhances the model adversarial robustness. The performance eval- uation of SAATup across different datasets, different model structures and different AT methods is provided in Appendix A where SAAT.., up boosts adversarial robustness under all settings, demon- strating the effectiveness of the proposed method. Note that the robust accuracy of SAAT up at e = 8 first increases and then decreases. This is defensible because as e and p increase, the robustness disparity of the output model is getting flatter, and the adversarial robustness will also be migrated relatively larger perturbation budget. addition, it can be observed that the performance gap between the last checkpoint and the best checkpoint of SAAT, up is shrinking, which illustrates that enhancing the hard-to-attack samples can also effectively alleviate robust overfitting.
4.4 PERFORMANCE UNDER DIFFERENT MODEL CAPACITIES
We extend SAAT networks with different model capacities. Specifically, perform SAAT on a series of Wide ResNet-34-x networks, where x 1, 3, 5, and 7 respectively. Note that the larger the x, the larger the model capacity. p is fixed at 1.5 and emar is sufficiently large, such
8

---

Under review as a conference paper at ICLR 2023
Robustness evaluation of SAAT and SAAT under adversarial budget 8. We omit the standard deviations of 3 runs as they are very small (the Natural is < 0.8%, the PGD-20 is 0.5%, and the AA is < 0.15%).
Table I:
Best
Last
Method
Natural
PGD-20
AA
Natural
PGD-20
AA
AT
82.02
52.59
48.23
83.89
45.28
42.88
SAAT down (Emaa = 8 1.5)
82.97
52.87
45.54
85.31
47.06
42.77
SAAT up (Cmaz 9.p 1.5)
81.04
53.00
47.72
82.82
46.49
43.66
S SAAT up (emaz 10, P- 1.5)
80.81
53.63
47.83
82.14
48.14
44.67
SAAT up (émaz 11, / 1.5)
77.99
54.38
47.90
80.55
48.86
44.85
SAAT up (Emaz = 12, 1.5)
77.50
54.78
48.04
79.44
50.03
45.42
SAAT (Emaz 13, 1.5)
77.40
55.21
48.26
78.48
51.68
45.55
SAAT up (6maz 14, 1.5)
76.80
55.59
48.61
77.44
52.80
46.46
SAAT up (Gmaz 15, 1.5)
76.62
56.18
48.45
76.36
53.62
46.12
SAAT up (Cmaz = 16, 1.5)
75.54
56.22
48.12
75.52
54.17
46.07
SAAT up (Emaz 17, 1.5)
74.21
56.35
47.95
74.49
54.33
45.73
SAAT up (Emaz 18, 1.5)
73.89
56.49
47.64
73.55
54.79
45.66
SAAT up (Emaz 19 = 1.5)
73.68
56.12
46.63
72.67
54.72
45.46
SAAT up (Emaz 20, p 1.5)
71.89
56.11
45.96
72.15
54.62
44.94
SAAT up (Emaz p 1.3)
78.40
54.87
48.08
78.49
51.68
45.77
SAAT up (Emaz 14, = 1.4)
77.45
55.04
48.23
78.20
52.40
45.79
SAAT up (Emaz 14, 1.5)
76.80
55.59
48.61
77.44
52.80
46.46
SAAT up (Emaz 14, =0==0 1.6)
76.48
56.08
48.76
77.16
53.11
46.57
SAAT up (Gmaz 14. p- 1.7)
76.37
56.31
48.86
76.38
53.86
47.17
SAAT up (Emaz = 14. 1.8)
75.51
56.18
48.85
76.11
53.42
46.73
SAAT up (Emaz 14, P 1.9)
75.10
55.58
48.59
75.46
53.20
46.53
SAAT up (Emaz
14, 2.0)
74.63
55.62
48.36
75.06
53.12
46.29
AWP-AT
81.47
55.54
49.96
80.20
54.88
49.28
AWP-SAAT down (Emaz 8 1.5)
83.74
56.97
48.38
82.85
55.16
46.99
AWP-SAAT (Emax 9,p= 1.5)
79.55
55.95
50.32
78.08
54.93
49.36
AWP-SAAT up (Emax = 10, 1.5)
78.14
56.20
49.98
76.66
55.12
48,89
AWP-SAAT up (Omaz 11. 1.5)
77.17
56.43
49.87
74.98
55.26
48.74
AWP-SAAT up (Cmaz = 12, 1.5)
76.00
56.76
49.43
73.49
55.33
48.22
AWP-SAAT up (Emaz 9,p 1.6)
79.52
56.00
50.35
78.06
54.97
49.12
AWP-SAAT (Emaz 9, = 1.7)
79.49
56.25
50.67
77.91
55.22
49.29
AWP-SAAT up (Cmaz
9.p 1.8)
79.32
56.05
50.26
77.88
54.98
49.18
AWP-SAAT up (Emaz 9, 1.9)
78.96
55.97
50.20
77.81
54.69
48.92
as Cmaz 128/222 228. The evaluation results are summarized in Figure 3 (e). It can be observed
that the output network can maintain steady degree of robustness disparity across different model capacities. Such observations exactly reflect the nature of our approach that SAAT is able to adapt to networks of various model capacities.
CONCLUSION
We present strength strength-adaptive adversarial training (SSAT) method in this paper. The proposed ap- proach distinguish itself from others by using the minimum adversarial loss constraint for generating adversarial training data, which adaptive to the dynamic training schedule and networks of various model capacities. We show that adversarial training loss is well-correlated with the degree of robust- ness disparity and robust generalization gap, empirically verify that SAAT can effectively alleviate robustness overfitting, mitigate the robustness disparity of output networks and further enhance the model adversarial robustness by adjusting the tradeoff of adversarial training, demonstrating the ef- fectiveness of the proposed approach. We hope that the robustness disparity offer further improve the completeness of adversarial robustness evaluation methods (Carlini et al.) 2019) and expect more techniques to be proposed achieve learning fully robust network.

---

Under review as a conference paper at ICLR 2023
REFERENCES
Maksym Andriushchenko, Francesco Croce, Nicolas Flammarion, and Matthias Hein. Square at- tack: a query-efficient black-box adversarial attack via random search. In European Conference on Computer Vision, pp. 484-501. Springer, 2020.
Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give false sense of curity: Circumventing defenses to adversarial examples. In International conference on machine learning, pp. 274-28: PMLR, 2018.
Yogesh Balaji, Tom Goldstein, and Judy Hoffman. Instance adaptive adversarial training: Improved accuracy tradcoffs in neural nets. arXiv preprint arXiv:1910008051, 2019.
Léon Bottou. On-line learning and stochastic approximations. In On-line learning in neural net- works, pp. 9-42. 1999.
Qi-Zhi Cai, Min Du, Chang Liu, and Dawn Song. Curriculum adversarial training. arXiv preprint 18X5. 2018.
Nicholas Carlini, Anish Athalye, Nicolas Papernot, Wieland Brendel, Jonas Rauber, Dimitris Tsipras, Ian Goodfellow, Aleksander Madry, and Alexey Kurakin. On evaluating adversarial 2019.
robustness. arXiv preprint
Yair Carmon, Aditi Raghunathan, Ludwig Schmidt, Percy Liang, and John C Duchi. Unlabeled data improves adversarial robustness. arXiv preprint 1905. 2019.
Minhao Cheng, Qi Lei, Pin-Ye Yu Chen, Inderjit Dhillon, and Cho-Jui Hsich. Cat: Customized adver- sarial training for improved robustness. arXiv preprint arXiv:2002.06788 2020.
Francesco Croce and Matthias Hein. Minimally distorted adversarial examples with fast adaptive boundary attack. International Conference on Machine Learning, pp. 2196-2205. PMLR,
2020a.
Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustmess with an ensemble of diverse parameter-free attacks. In International conference on machine learning, pp. 2206- 2216. PMLR, 2020b.
Jacob Devlin, Ming- Wei Chang. Kenton Lee, and Kristina Toutanova. Bert: Pre-training of deep bidirectional transformers for language understanding. arXiv preprint arXiv:1810.04805 2018.
Gavin Weiguang Ding, Yash Sharma, Kry Yik Chau Lui, and Ruitong Huang. Mma training: Direct input space margin maximization through adversarial training. arXiv preprint arXiv:18/2.02637 2018.
Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572, 2014.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 770-778, 2016.
Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.
Feng Liu, Bo Han, Tongliang Liu, Chen Gong, Gang Niu, Mingyuan Zhou, Masashi Sugiyama, et al. Probabilistic margins for instance reweighting in adversarial training. Advances in Neural Information Processing Systems, 34:23258-23269, 2021.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv: 2017.
Preetum Nakkiran. Adversarial robustness may be at odds with simplicity. arXiv preprint 10X1v/90110000 2019.
10

---

Under review as a conference paper at ICLR 2023
Aditi Raghunathan, Sang Michael Xie, Fanny Yang. John Duchi, and Percy Liang. Understanding and mitigating the tradeoff between robustness and accuracy. arXiv preprint arXiv:2002.10716, 2020.
Leslie Rice, Eric Wong, and Zico Kolter. Overfitting in adversarially robust deep learning. In International Conference on Machine Learning, pp. 8093-8104, PMLR, 2020.
Chawin Sitawarin, Supriyo Chakraborty, and David Wagner. Improving adversarial robustness through progressive hardening. 2020.
David Stutz, Matthias Hein, and Bernt Schicle. Disentangling adversarial robustness and generaliza- tion. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pp. 6976-6987, 2019.
Dong Su, Huan Zhang, Hongge Chen, Jinfeng Yi, Pin- Yu Chen, and Yupeng Gao. Is robustness the cost of accuracy?-a comprehensive study on the robustness of 18 deep image classification models. In Proceedings of the European Conference on Computer Vision (ECCV), pp. 631-648, 2018.
Christian Szegedy, Wojeiech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199, 2013.
Dimitris Tsipras, Shibani Santurkar, Logan Engstrom, Alexander Turner, and Aleksander Madry. Robustness may be at odds with accuracy. arXiv preprint arXiv: 12152, 2018.
Yisen Wang, Xuejiao Deng, Songbai Pu, and Zhiheng Huang. Residual convolutional ctc networks for automatic speech recognition. arXiv preprint arXiv: 1702v:170,.07793, 2017.
Yisen Wang, Xingjun Ma, James Bailey, Jinfeng Yi, Bowen Zhou, and Quanquan Gu. On the convergence and robustness of adversarial training. In ICML, volume 1, pp. 2, 2019a.
Yisen Wang, Difan Zou, Jinfeng Yi, James Bailey, Xingjun Ma, and Quanquan Gu. Improving adversarial robustness requires revisiting misclassified examples. In International Conference on Learning Representations, 2019b.
Yao-Yu Yuan Yang, Cyrus Rashtchian, Hongyang Zhang, Russ Salakhutdinov, and Kamalika Chaud- huri. A closer look at accuracy vs. robustness. Advances in neural information processing systems, 33:8588 8601, 2020.
Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In International Conference on Machine Learning, pp. 7472-7482, PMLR, 2019.
Jingfeng Zhang, Xilie Xu, Bo Han, Gang NIu, Lizhen Cui, Masashi Sugiyama, and Mohan Kankan- halli. Attacks which do not kill training make adversarial learning stronger. In International Conference on Machine Learning, pp. 11278-1127. PMLR, 2020a.
Jingfeng Zhang, Jianing Zhu, Gang Niu, Bo Han, Masashi Sugiyama, and Mohan Kankanhalli. Geometry-aware instance-rewwiigheed adversarial training. arXiv preprint arXiv:2010.01736. 2020b.
A APPENDIX
In this part, we conduct extended comparative experiments. Specifically, we conduct experiments under different datasets, different model structures and different AT methods. The results are sum- marized in Table and Table 3 Experimental results show that the proposed method can achieve higher adversarial robustness under all settings, demonstrating the effectiveness of the proposed approach.
11

---

Under review as a conference paper at ICLR 2023
Table 2: Robustness evaluation of SAAT up (best checkpoint) under adversarial budget = 8 across different datasets, different network structures and different AT methods, where PR-18 indicates PreAct ResNet-18 18 and WRN-34-10 10 indicates Wide ResNet-34-10.
Best
Dataset
Network
Basic AT
Method
Natural
PGD-20
AA
CIFARIO
PR-18
AT
AT SAATup up
82.02
52.59
48.23
CIFARIO
PR-18
AT
76.37
56.31
48,86
CIFARIO 10
PR-18
AT
AWP-AT
81.47
55.54
49.96
CIFARIO
PR-18
AT
AWP-SAAT
79.49
56.25
50.67
CIFAR 100
PR-18
AT
AT
55.95
28.84
24.71
CIFAR
PR-18
AT
SAAT up
53.20
29.29
25.25
CIFARI00
PR-18
AT
AWP-AT
56.64
32.02
26.43
CIFARI00
PR-18
AT
AWP-SAAT up
54.36
32.09
26.98
CIFAR I0
PR-18
TRADES TRADES
TRADES
81.09
52.70
48.91
CIFARIO
PR-18
SATRADES
81.76
53.44
50.04
CIFARIO
PR-18
TRADES AWP-TRADES
81.64
55.52
51.38
CIFAR1O
PR-18
TRADES AWP-SATRADES.pp
80.76
55.98
51.72
CIFARIO
WRN-34-10
AT
AT
85.47
54.87
51.70
CIFARIO
WRN-34-10
AT
SAAT up
79.94
58.52
52.36
CIFAR1O
WRN-34-10
AT
AWP-AT
86.00
58.78
54.06
CIFARIO
WRN-34-10
AWP-SAAT up
83.55
59.20
54.64
Table 3: Robustness evaluation of SAAT up (last checkpoint) under adversarial budget across different datasets, different network structures and different AT methods, where PR-18 18 indicates PreAct ResNet-18 18 and WRN-34-10 indicates Wide NesNet-34-10.
Last
Dataset
Network
Basic AT
Method
Natural
PGD-20
AA
CIFARIO
PR-18
AT
AT
83.89
45.28
42.88
CIFAR10
PR-18
AT
SAAT
76.38
53.86
47.17
CIFARI0
PR-18
AT
AWP-AT
80.20
54.88
49,28
CIFAR1O
PR-18
AT
AWP-SAAT
77.91
55.22
49.29
CIFAR 100
PR-18
AT
AT
56.75
21.12
19.35
CIFAR100
PR-18
AT
SAAT
54.52
22.32
20.12
CIFAR100
PR-18
AT
AWP-AT
57.18
31.64
26.45
CIFAR 100
PR-18
AT
AWP-SAAT up
55.08
31.72
27.04
CIFARIO
PR-18
TRADES TRADES
TRADES
82.40
49.98
47.02
CIFAR10
PR-18
SATRADES
81.30
51.13
47.99
CIFAR10
PR-18
TRADES AWP-TRADES
81.87
55.41
51,27
CIFARIO
PR-18
TRADES AWP-SATRADES...
80.64
55.62
51.60
CIFAR1O
WRN-34-10
AT
86.16
46.94
45.68
CIFARIO 10
WRN-34-10
AT
SAAT up
80.19
55.47
49.98
CIFARIO
WRN-34-10
AT
AWP-AT AWP-SAAT
87.08
57.96
53.41
CIFARIO
WRN-34-10
AT
84.05
58.76
54.16
12


Reviews:
[{"review_id": "MWZzgkiV9Ww", "reviewer": "Reviewer_snup", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper proposes Strength-Adaptive Adversarial Training (SAAT) to improve adversarial training. Specifically, SAAT adopts a dynamic and adaptive strategy to control the adversarial attack budget. Instead of setting a fixed adversarial budget, this paper proposes to enlarge the budget while attacking. The proposed SAAT is evaluated on CIFAR-10 with Resnet-18. Some marginal improvements are observed.", "summary_of_the_review": "The proposed method is straightforward, clean, and naive. Performances are my biggest concern. SAAT\ndoesn’t show any improvements under common adversarial evaluation settings but hurts a lot of baseline\nperformances.", "strength_and_weaknesses": "**Strengths:**\n\n1. The proposed idea is very straightforward and clean, although I have some questions regarding the proposed pseudo-codes.\n2. Experimental results show that SAAT can achieve consistent yet marginal improvements over vanilla\nadversarial training and AWP.\n\n**Weaknesses:**\n1. Adopting adaptive attacking budget during adversarial training has been highlighted by many previous\nwork. The proposed SAAT is just a simple early stop (loss value) based on some empirical observations,\nwhich in my personal view is not novel.\n2. In Alg.1, considering that step size $\\alpha$ is the same as perturbation budget step size $\\tau(2/255)$, what is\nthe meaning of enlarging epsilon by $\\tau$ every attacking step? The real adversarial perturbation will be\nbounded by the step size (if ignoring [min, max] clipping). So in my view, the adaptive attack budget is\njust the normal PGD using $\\epsilon = \\epsilon_{max}$. Besides, the break in Line 12 only jumps up of the inner for-loop.\nDoes this mean that attacking will continue after enlarging the epsilon for this adv. example whose loss\nhas already been greater than $\\rho$?\n3. By setting SA-PGD step K = 3, the proposed SAAT might adopt much more attack steps to train\ntheir models. For example, with $\\epsilon_{max}$ = 8/255, $\\tau$ = 2/255, the actual attack steps might be at most\n$\\epsilon/T*K = 12$. When $\\epsilon_{max}$ = 14/255 (common setting in this paper’s experiments), the attack steps\nmight be at most 21. A lot of computational costs will be introduced in SAAT.\n4. The proposed SAAT doesn’t show any improvements under common adversarial evaluation settings\n(eps=8/255) and only marginal improvements can be observed on vanilla adversarial training and AWP\nunder very specific settings. Besides, SAAT hurts clean accuracy very much. Only experiments on\nCIFAR-10 and Resnet-18 are provided. The authors should conduct experiments on other architectures\nwith larger capacities and benchmarks (CIFAR-100).", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "Not applicable"}, "extra_text": {}}, {"review_id": "K9JeEWlxiq", "reviewer": "Reviewer_e7uD", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The paper works on adversarial training, a well-known defense for adversarial samples. It aims to address the problem of robustness over-fitting, which refers to the phenomenon that training with a fixed budget degenerates model performance. The authors propose a method called Strength-Adaptive Adversarial Training, which can update the strength of the attacks during the training process. \n", "summary_of_the_review": "Although the paper has some interesting findings, it bears some severe weaknesses, like a lack of novelty, ignoring related work, and few baselines.", "strength_and_weaknesses": "Strength\n1. The algorithm is fit for networks of various model capacities.\n2. Figure 2 (d) shows robustness differences between the \"best\" and \"last\" checkpoints, which is interesting.\n\nWeakness\n1. About motivation: I question the novelty of your motivation that using a dynamic perturbation budget can alleviate robustness over-fitting. In fact, Cai et al. [1] adjust the iteration numbers of PGD to control the adversarial strength. Similarly, Kim et al. [2] directly manipulate the step size of FGSM to overcome the question. At least, you should cite these works in the introduction part of your paper.\n\n2. About methods: Your work introduces a new parameter $\\rho$ and uses a heuristic method to adjust it. However, why not apply the same heuristic method to $\\epsilon$ directly? So you can adjust the adversarial budget during training. I hope you can do some additional experiments to demonstrate the advantage of introducing $\\rho$.\n\n3. About methods: You claim that your method can cope with different model capacities. However, I do not see such an experiment in your paper. Could you train some models of different architectures adversarially with the same $\\rho$?\n\n4. About Experiments: Your paper bears a lack of baselines. Please add some evaluation on related works (like [1,2]) to Table 1. Note that you should evaluate these methods under the same budget. \n\n\n\n\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "FRdGsUuHMag", "reviewer": "Reviewer_HbG6", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The paper discusses the issue of adversarial training over-fitting, pointing out that a pre-specified perturbation budget is not optimal as the training progresses the perturbation budget should be adjusted accordingly. Based on this intuition, the author proposes a new adversarial training method that generates adversarial examples by maintaining a minimum adversarial loss instead of searching for the point that maximizes the loss. Experiments on CIFAR10 show that the proposed method outperforms standard adversarial training and when combined with AWP, it also outperforms standard adversarial training with AWP.", "summary_of_the_review": "Due to the lack of experiments support, the paper is below the acceptance threshold.", "strength_and_weaknesses": "Strength:\n\n- The paper is clearly written with intuition and finding discussed in detail. \n\n- Experiments show that the proposed method outperforms standard adversarial training on CIFAR10\n\nWeakness:\n\n- The proposed method lacks theoretical and empirical support. Even though, some experiments are done on CIFAR10, but one dataset is not enough to show that the method works well in general. Besides, there have been many new adversarial training methods proposed since 2018 (the year standard adversarial training was proposed). The author also discusses some in the paper, but why not compare with those methods in the experiments? There have also been works about adaptive adversarial training. Lack of experiments is the key issue of the paper.", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "B-wd5riJwZ6", "reviewer": "Reviewer_AoDK", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This work proposes adversarial training with a threshold of minimum adversarial loss, i.e., while the training adversarial example cannot reach the minimum loss, expand its attack radius.", "summary_of_the_review": "This is an experiment based work without deep (theoretical) analysis, it only presents weak empirical results with a straight-forward idea, i.e., a trade-off between clean accuracy and adversarial accuracy (under AA) with SAAT. For this reason, I think it is below the bar of ICLR. ", "strength_and_weaknesses": "Strength:\n1. Well written and easy to follow\n2. Idea is straight forward\n\nWeaknesses:\n1. A little novelty. For me, setting a minimum adversarial loss during adversarial training is not exciting.\n\n2. Weak experiments.   \n(a) There is just a trade-off between adversarial accuracy (under auto attack) and clean accuracy in the experiments, i.e., increase (adaptive) adversarial attack strength during training -> improve test adversarial accuracy and damage test clean accuracy.  \n(b) In the current development of adversarial training, Wide ResNet-34-10 on CIFAR-10/100 is necessary, where TRADES-AWP can get a better performance under auto attack. I wonder the performance of SAAT under these settings. (i.e., the results of Tab. 1 with WRN-34-10 and TRADES-AWP).\n\n3. Experiment-based work without deep analysis.", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}]

Author rebuttal:

Decision: Reject