Standard-Deviation-Inspired Regularization for Improving Adversarial Robustness
Authors: Olukorede Fakorede
Modeste Atsague
Jin Tian
Venue: Accepted by TMLR ()

Abstract: Adversarial Training (AT ) has been demonstrated to improve the robustness of deep neural networks (DNNs) to adversarial attacks. AT is a min-max optimization procedure wherein adversarial examples are generated to train a robust DNN. The inner maximization step of AT maximizes the losses of inputs w.r.t their actual classes. The outer minimization involves minimizing the losses on the adversarial examples obtained from the inner maximization. This work proposes a standard-deviation-inspired (SDI ) regularization term for improving adversarial robustness and generalization. We argue that the inner maximization is akin to minimizing a modified standard deviation of a model’s output probabilities. Moreover, we argue that maximizing the modified standard deviation measure may complement the outer minimization of the AT framework. To corroborate our argument, we experimentally show that the SDI measure may be utilized to craft adversarial examples. Furthermore, we show that combining the proposed SDI regularization term with existing AT variants improves the robustness of DNNs to stronger attacks (e.g., CW and Auto-attack) and improves robust generalization.

Published in Transactions on Machine Learning Research (12/2024)
Standard-Devvatioon-nnsiie Regularization for Improving Adversarial Robustness
'llukorede Fakorede
hukboredefakorede@gmaalccom fakstede
Deportment of Computer Science lowa State University, Ames, Iowa, USA
Modeste Atsague
modeste Wiastate. edu
Deportment of Computer Science lowa State University, Ames, Iowo, USA
Jin Tian
jin.tion www.lann@mbzzaii.co
Mohamed bin Zoyed University of Artificial Intelligence
Abu Dhabi, United Arab Emirates
Reviewed on OpenReview: https: // optp//veew.eee...eo net/ forum? id- 6af
Abstract
Adversarial Training (AT) has been demonstrated to improve the robustness of deep neural networks (DNNs) to adversarial attacks. AT is min-max optimization procedure wherein adversarial examples AT maximizes the losses of inputs w.r.t their actual classes. The outer minimization involves minimizing the losses on the adversarial examples obtained from the inner maximization This work proposes a deaudaardddvviatiin--nniper (SDI) regularization term for improving adversarial robustness and generalization. We argue that the inner maximization akin to minimizing a modified standard deviation of model's output probabilities. Moreover, we argue that maximizing the modified standard deviation measure may complement the outer minimization of the AT' framework. To corroborate
generated to train robust DNN. The inner maximization step of
argument, experimentally show that the SDI measure may be utilized to craft adversarial examples. Furthermore, we show that combining the proposed SDI regularization term with existing AT' variants improves the robustnoss of DNNs to stronger attacks (c.g., CW and Auto-attack) and improves robust generalization.
1 INTRODUCTION
The vulnerability of deep neural networks (DNNs) to adversarial perturbations is well documented in machine learning literature [Goodfellow et al.] 2014 Moosavi-Dezfooli et al., 2016 Papernot et al. 2016 Szegedy et al. 2013), prompting concerns about the deployment of DNNs into safety-critical domains. Hence, for the safe deployment of DNNs, improving their robustness to adversarial perturbations is imperative.
Adversarial Training (AT) Goodfellow et al. (2014): Madry et al. (2018) has been demonstrated be effective in improving the robustness of DNNs adversarial attacks. AT is min-max optimization procedure, where the inner maximization step corresponds to finding adversarial examples in the direction of worst-case loss. The outer minimization minimizes the loss the crafted adversarial examples. The success of AT in improving the robustness of DNNs to adversarial perturbations has inspired a myriad of variants that have yielded better robustness or computational efficiency (Zhang et al.) 2019 Wang et al. 2019: Li et al.] 2019 Andriushchenko & Flammarion 2020 Wong et al.] 2020 Shafahi et al. 2019b). Furthermore, recent works
have employed methods such as adversarial weight perturbation Wu et al. 2020), integration of hypersphere
Corresponding author

---

Published in Transactions on Machine Learning Research (12/2024)
embedding into AT Pang et al. 2020; Fa Fakorede et al. 2023a and loss re-weighting Zhang et al. (2020)
Liu et al. (2021] Fakorede et al. (2023b) Zhang et al. (2023) to improve the performance of existing AT variants.
(SDI) measure proposed in a recent study in (Fakorede al., 2024) for estimating the vulnerability of an input example. Drawing inspiration from the concept of standard deviation, which quantifies the dispersion of data points around the mean of distribution, the SDI measure aims to capture the dispersion of logits associated with incorrect classes in relation to the logits corresponding to the true class.
In this work, we delve into a flandard-deviation-ii
We draw parallel between the inner maximization step of the AT process and minimizing the SDI loss function. Moreover, we argue that the outer minimization step of the AT process, which seeks model param- eters minimizing the loss on adversarial examples, is conceptually similar to maximizing the SDI measure. Both endcavors aim to enhance the likelihood of correctly classifying individual adversarial examples.
Unlike prevalent informationn-hherelle losses utilized in min-max AT optimization, the SDI measure operates independently from concepts like cross-entropy, entropy, Kullback Leibler divergence. Consequently, integrating the SDI mcasure into existing AT variants could complement information--theor--innoii and potentially enhance the performance of these variants. Therefore, we propose adding the SDI loss as a regularization term to prominent AT variants such as the standard AT (Madry et al. 2018) and TRADES (Zhang et al. 2019). The proposed regularization term is applied to outer minimization of the respective AT variants maximize the SDI measure.
losses
Our contributions summarized follows:
We propose utilizing the SDI mcasure as a regularization term to cxisting AT variants. Our exten- sive experiments show that our proposed approach further improves the robustness of existing AT variants strong attacks Auto attacks and CW attack and strong query-based black-box attack SPSA.
2. We experimentally show that the proposed SDI regularization on existing AT variants improves the generalization to other attacks not seen during adversarial training.
3. In addition, we establish a connection between minimizing the SDI measure and the inner maximiza- tion of the min-max AT' procedure. Specifically, experimentally show that adversarial examples may be obtained from adversarial perturbations that minimize the SDI metric. Furthermore, we compare the success rates of adversarial examples obtained using the SDI metric with those obtained using cross-entropy loss and KT, divergence on adversarial trained models.
2 BACKGROUND AND RELATED WORK
2.1 NOTATION
We use bold letters to represent vectors. We denote D (x a data set of input feature vectors x; E X Rd and labels y, e V, where X' and y represent a feature space and a label set, respectively.
Let fo X RC denote deep neural network (DNN) classifier with parameters 6, and |C| represents the number of output classes. For any X, let the class label predicted by So be Fo(x) arg max fx()). where fx(x denotes the k-th component of fo(x). fo(x), is the probability of having label y.
We denote || Ipp as the 4o- norm over Rd, that is, for a vector x E Rd |x|| = EEin Ix) An e- neighborhood for x defined as (x(x) fx' E I|x' - -XIpp I c). An adversarial example corresponding to natural input x is denoted as x'. We often refer to the loss resulting from the adversarial attack (inner maximization) adversarial loss.
2

---

Published in Transactions on Machine Learning Research (12/2024)
2.2 ADVERSARIAL ROBUSTNESS
Adversarial robustness is a machine learning model's capability to resist adversarial attacks. Over the past years, many methods (Guo et al.; 2018 Buckman et al. 2018 Dhillon et al. 2018 Madry et al.) 2018 Goodfellow et al. 2014 Zhang et al., 2019 have been proposed to improve adversarial robustness of neural networks. However, some of these defenses have been shown to provide a false sense of defense because they intentionally or inadvertently used obluscated gradients in their defenses (Athalye et al. 2018).
In seminal work, Madry al. (0018) proposed Adversarial training (AT), which involves training the model with adversarial examples obtained under worst-case loss to improve robustness. Formally, AT involves solving min-max optimization as follows:
min E (x.))=D
max ((fo(x')))) (x)
where L() represents the loss function, y is the true label of input feature x, and 0 are the model parameters. The inner maximization in Eq. ( aims to obtain a worst-case adversarial version of the input x that increases
the loss. The outer minimization then trics to find model parameters that would minimize this worst-case adversarial loss. The eflicacy of AT has spurred the development of numerous variants (Zhang et al. 2019
Wang et al. 2019 Wu et al. 2020 Pang et al. 2020).
A prominent variant TRADES Zhang et al. (019 proposed a principled regularization term that trades off adversarial robustness against natural accuracy. Wang et al. (2019) proposed MART, an AT variant that differentiates between naturally misclassified examples that are used in the inner maximization of the AT process, using this information to improve adversarial robustness. [Wu et al. (202)) proposed adversarial weight perturbation, double perturbation mechanism that employs the perturbation of inputs and weights to improve adversarial robustness. More recent AT methods improve existing AT variants by employing
reweighting (Zhang et al., 2021 Liu et al.) 2021 Fakorede et al. 2023bb or incorporating hypersphere embedding (Pang et al. 2020 Fakorede et al. 2023a
The adversarial examples obtained in the inner maximization step of adversarial training methods are typi- cally crafted using the projected gradient descent (PGD), maximizing the probability estimates of incorrect classes at the expense of the ground truth. Training these specific adversarial types often leads to models performing well on the PGD adversarial attacks, on which the models are trained but generalizing relatively poorly to others. To address this, we propose a standard-deviatioo-nnppe that explicitly maximizes the probability gap between incorrect classes and the ground truth while boosting the ground-truth probability. This proposed regularization operates directly on the model output logits, categorizing it as a form of logit regularization.
regularization term
2018 Kannan et al., 2018 Shafahi et al. 2019b; Summers& & Dinncen 2019 Kanai et al. 2021) involve utilizing techniques such as label smoothing and logit squeezing for improving adversarial robustness. These methods typically encourage smaller logit norms before softmax, which studies such as Shafahi et al. (2019bla) a) associate with reduced overconfidence in predictions and improved adversarial robustness. However, the robustness achieved through these logit regularization mothods has boen criticized as potentially attributed to gradient obfuscation (Athalye et al. 2018 Engstrom et al. 2018 Lee el al.] 2020; Raina et al. 2024).. In contrast, our method operates on the post-sofl logits. It explicitly maximizes the probability gap between actual classes and the probability of incorrect classes, maximizing the confidence in the true classes of individual training samples. Our extensive experiments show the broad effectiveness of our approach in improving adversarial robustness to various adversarial allacks.
Most existing logit regularization variants (Mosbach
2.3 STANDARD DEVIATION AS A RISK MEASURE
The standard deviation measures the spread of distribution around the mean of that distribution. The standard deviation of distribution is given as:
-= (z; 11)2
SD
(2)
N
3

---

Published in Transactions on Machine Learning Research (12/2024)
where is data-point, is the population mean, and N is the number of data-points in the distribution. A smaller SD value suggests that data points are more clustered, whereas larger SD value indicates that data points are farther from the mean. The properties of standard deviation have made it useful measure of risks in various domains. For example, the standard deviation used as a risk mcasure in finance to measure market volatility and risk of assets and portfolios by indicating how much the returns of an asset deviate from the mean return (Artzner et al. 1999: Hull 2012: Ross al. 2019).
Drawing inspiration from the widely used standard deviation statistic, recent work by Fakorede et al.) (024)) proposes modified standard deviation measure for scoring and characterizing the vulnerability of individual natural examples. Inspired by this work, our paper further argues standard-deviaaion--nss measure to be utilized to capture the risk of misclassification of training samples.
3 PROPOSED METHOD
Here, we justify the introduction of a sonidard-Devaation-nnee (SDI) measure as a regularization term into existing adversarial training approaches.
The SDI measure was originally proposed in Fakorede et al. (0224) for the purpose of estimating the vul- nerability of natural examples. In this paper, we connect the SDI mcasure to the min-max optimization concept in adversarial training and use it as a regularization term.
3.1 THE SDI MEASURE
The SDI measure adopls an idea similar to standard deviation to characterize the spread of output prob- ability vectors of DNN models for individual training examples. Specifically, the approach measures the variation of a model'ss estimated probabilities for incorrect classes around the model's estimated probability for the true label of individual input examples x. Formally, given an input-label pair (x,,3s) and the output probabilities of DNN model input sample x; denoted as fo(x;), the SDI measure is given as:
EES (fo(:)) ( C
- fo(x)),.
(x.,(xx,,;,00 (X1,
(3)
where |C| is the number of output classes, fe(x;); ) is the model's estimated probability corresponding to class ki fo (x;),. the model's estimated probability of the true class, and denote the model parameters.
Under the condition where fe(x;),, 2 max (x:)), the MSDI (x,, Vi,0) 0) measure serves capture the vulnerability and risk of misclassification of individual examples x, A smaller value of MxDI V:. suggests that the output probabilities returned for sample are more evenly distributed among classes, indicating a higher likelihood of misclassification as the model may misclassify it into any of the k incorrect classes.
3.2 AN SDI-ORIENTED PERSPECTIVE TO ADVERSARIAL TRAINING
In this section, we provide an explaination of the MsDr measure from the perspective of the min-max optimization framework of adversarial training.
AT methods are typically formulated as min-max optimization procedures. The inner maximization step of the AT approach involves generating adversarial examples x from natural examples x; by iteratively adjusting the input data in directions that maximize the loss, using projected gradient descent (PGD) algorithm as follows:
x + (x, + a- wennsign((V Lix v))).
(4)
where II is the projection operator and L is a loss function.
Essentially, the adversarial examples produced during the inner maximization process are tailored to reduce the model's confidence correctly classifying them into their true classes. Morcover, the resulting adver- sarial examples are untargeted, i... the inner maximization misclassifies the adversarial examples without prioritizing any particular incorrect class.
4

---

Published in Transactions on Machine Learning Research (12/2024)
The Mypr (X4, Ve. f) mcasure estimates the vulnerability of individual imputs into a DNN model, using the spread of the model's estimated probabilities w.r.t. the model's estimated probability of the actual class of each input. Smaller values of MMDr Vr, 0) for the output probability vector of a model indicate that the predicted probabilities are more concentrated or similar, reflecting lower confidence in the true class of the input. Therefore, the magnitude of M M/. 0) value for an input-label pair (x,, 34) is indicative of the degree of risk misclassifying x,. In contrast, a large value of MSDS (X,, yr, 0) indicates that the model assigns high probability to class yi for Vi, suggesting strong confidence in the prediction and low risk of misclassification.
This observation suggests that adversarial examples may be generated simply by finding adversarial pertur- bation along the gradient direction that minimizes the Msnt metric. We might use Msnr for generating adversarial examples as follows:
x (xf - a- signiiggVVv VVx; (xDMMsD(X' Mi, 0)))
The above adversarial example generation is achieved using the widely adopted PGD algorithm (Madry et al. 2018), with the notable difference that the sign of the gradient is inverted to move in the opposite direction. For most AT variants, adversarial examples in the inner maximization step are obtained by finding perturbations that maximize a cross-entropy loss function or a Kullback- mcasure does not rely on information-theorete measures. Therefore, it offers a complementary approach for finding adversarial examples. We provide experimental evidence for our claim in Sec. 4.5
divergence. The SDI
The outer minimization seeks model parameters that minimize the loss on the adversarial examples generated during the inner maximization step. Essentially, the outer minimization process aims to maximize the likelihood of correctly classifying individual adversarial training examples. Invariably, the outer minimization minimizes the likelihood of incorrect classification by increasing the probability gap between the example belonging to the label and belonging to incorrect classes, This conceptually aligns with the goal of maximizing the SDI mcasure. Maximizing the SDI metric encourages the model to correctly classify the input to its true class by widening the probability gap between the estimated probability for the true class and the estimated probabilities for other incorrect classes. Moreover, when fo(x;), 2 ma fo (x;):: maximizing the MSDI measure maximizes So (x()))
3.3
SDI REGULARIZATION
Here, we propose the SDI regularization term for improving adversarial training.
Typically, adversarial training techniques involve training models using adversarial examples generated by various forms of PGD attacks. However, this approach may lcad to overly specialized models defending against PGD attacks, potentially causing poor generalization to different atlack lypes. As discussed earlier, the MSDI metric introduced the previous section has beneficial characteristics, particularly its ability to maximize the probability gap between the true class and the other classes. This property aligns well with the objectives of adversarial training, enhancing its effectiveness. Hence, to improve the robust generalization and performance of existing AT methods, we propose adding a regularization term that maximizes the MSDI measure on each training example.
Maximizing the MSDI metric as a regularization term encourages the model to maximize the output prob- ability of a training example belonging to its actual class, thus improving training. Moreover, since existing AT variants depend on information-theorrde measures for both the inner maximization step and the outer minimization step, applying the Mspr metric as a regularization term offers a complementary addition to AT methods that does not depend on the iiformation-thhoreeee Lastly, maximizing the Msps metric facilitates the widening of the probability gaps between the probability of the actual class of individual adversarial examples and the probabilities corresponding to incorrect classes, thus improving the discriminability of the model.
measures that these AT methods are based.
Note that maximizing the MSDI measure to improve fo(x;), is only valid when fo 2 max fe( (x(;)) k- When fx(x;,, < ma fo(x)). maximizing MSDI may further minimize fx since the probability gap between each so (x)),, and fo (x.)y is further increased to maximize the MSDI measure. Therefore,
5

---

Published in Transactions on Machine Learning Research (12/2024)
propose regularization term LSDr that selectively maximizes the MsDs measure samples whose output probabilities satisfies fx(x:), 2 maxi,k7y So (x):)--
We utilize the multi-class margin from [Koltchinskii & Panchenko 2002 to determine input samples satisfy- ing the desired conditions. For a DNN denoted by fo and the input- label pair (x4, y:), the margin (x,, 3/: 6) is given as follows:
dm (x ye 0) fx(())
max fa(x (xi)a: k,
where [o(x))y, is the model's predicted probability of the correct label ye, and maxkAyu fo(x)) is the maximum prediction of the remaining classes.
The proposed SDI regularization term is formally described as follows:
Msnr vn:)) if dm (x;, Mei 8) 2 otherwise
LSDI (x,, 06:0)
0,
In this paper, we apply the Lspr xx, yı; 0150) regularization term to two prominent adversarial training methods:
standard AT (Madry et al., 2018) and TRADES (Zhang et al. 2019). We refer to the SDI-regularized standard AT and TRADES as AT-SDI and TRADES-SDI respectively. The regularized training objectives are stated as follows: AT-SDT:
Σ [eer((o()).v)) - B Lsmi(X
(8)
TRADES-SDI:
Σ LC KL(((()))II((<)) - B LSDr(x w.
(9)
where 3 in Eq. regularization term, and KL Eq. 99 represents Kullback Leibler divergence. the proposed AT-SDI and TRA DES-SDI, the Lsnt regularization term selectively applied. The regularization term only applied adversarial training instances satistying:fe(x/] 2 maxk, key fo(x))) If fo(x))y maxk, fo(x() on a sample x4, the normal AT or TRADES adversarial training is applicd on x/.
8 or 99 represents the regularization hyperparameter for controlling the weight of the SDI
As an example, the proposed AT-SDI algorithm for adversarial training is presented in the following.
4 EXPERIMENTS
In this section, we conduct an extensive evaluation of the proposed method. To assess its versatility, we test it on various datasets, including CIFAR-10 (Krizhevsky et al.) 2009), CIFAR-100 (Krizhevsky et al. 2009). SVHN (Netzer et al., 2011), and Tiny ImageNet Deng et al. (2009). We apply simple data augmentations, such as 4-pixel padding with Additionally, we employ ResNet-18 18 (He al. 2016) and WideResNett311 (He et al. 2016) as the backbone models.
32 random crop and random horizontal flip, cach of the datasets.
4.1 EXPERIMENTAL SETUP
4.1.1 Training Parameters.
We train the backbone networks using mini-batch gradient descent for 110 epochs, with a momentum of 0.9 and a batch size of 128. For training CIFAR-10, we used a weight decay of 5e-4, and for CIFAR-100, SVHN, and TinyImageNet, we used weight decay of 3.5c-3. The initial learning rate was set to 0.1 (0.01 for CIFAR-100, SVHN, and TinylmageNet), and it was divided by 10 at the 75th epoch and then again the 90th epoch.

---

Published in Transactions on Machine Learning Research (12/2024)
Algorithm 1 AT-SDI Algorithm.
Input: a neural network model with the parameters step size K, T PGD steps, a training dataset D of size n, |C] is the number of classes, and hyperparameter B.
Output: robust model with parameters 0*
1: for epoch = 1 to num epochs do num batchs do sample mini-batch {(x,, hi) from D; for i,= to
for batch
mini-batch of size. M.
X; < x; + 0.001 (O 1); N(O, I) is Gaussian distribution with zero mean and identity variance.
6:
for 1 = to T do
7:
x - 11 (x.) + sign( (V (x)
end for end for (xDr(x vx E (ala))) - So (o
10:
[C|-1
11:
d.n (x/, yz:0 fo(x))n k (x(
12:
if d. (X,, ue: 0) 0 then
13:
LSDI(X, (X,, 0) (x4,
14:
15:
end LSDi y4:
16:
17:
+ - V M E (cE(fo(x).v) - ISDD (x438))
18:
end for
19:
end for
4.1.2 Hyperparameters.
We set the value of 3 to 3.0 for training AT-SDI and TRADES-SDI on CIFAR-10, SVHN, and TinyImagenel. For CIFAR-100 using AT-SDI and TRADES-SUD DD,,,,,,,, we set 3 to 3.0. When incorporating AWP (Wu et al. 2020j into AT-SDI and TRADES-SDA we respectively set / to 3.0 and 1.0. The hyperparamcters are tuned using a validation set. We provide the sensitivity analysis of 3 hyperparameter on AT-SDI and TRADES-SD. for CIFAR-10 using 11deresnet-34-10 Tables
and 10
4.2 BASELINES
We use prominent methods Standard AT (Madry et al. 2018 and TRADES Zhang et al. 2019 baselines. In addition, we compare our results to other popular works MART (Wang et al. 2019), AWP (Wu et al. 2020), MAIL (Liu et al., 2021), and ST-A7 (Li et al. 2023). All hyperparameters of the baseline methods remain consistent with those in their original papers. Nevertheless, we maintain consistency by using the same learning rate, batch size, and weight decay values as those utilized during the training of our proposed method.
4.3 THREAT MODELS
We evaluate the performance of the proposed method against strong attacks under white-boz and black-bor bor settings, as well as the Auto attack.
White-box attacks These attacks have access to model parameters. To assess robustness on CIFAR-10 using Resnet-18 and Wideresnet-34-10, we employ the PGD attack with c = 8/255, step size K == 1/255, and K 20 ilerations (PGD-20). Additionally, we utilize the CW attack (CW loss (Carlini & Wagner 2017] optimized by PGD-20) with 8/255 and step size 1/255. On SVHN and TinylmageNet, we use the PGD attack with 8/255, step size 1/255, and K = 20 iterations.
Black-box attacks. In black-box settings, the adversarial allack method does not have access to the model parameters. We evaluate robust models trained on CIFAR-10 10 against strong black-box attack, SPSA (Uesato et al. 2018), with 100 itcrations. These attacks use perturbation size of 0.001 for gradient estimation, a learning rate of 0.01, and 256 samples for each gradient estimation. All black-bor evaluations are conducted trained Wideresnet-34-10.
7

---

Published in Transactions on Machine Learning Research (12/2024)
Auto attacks (AA). Lastly, assess the robustly trained models using Autoattack (lee and (2)
Croce &
Hein 2020b which is a powerful ensemble of attacks consisting of APGD-CE (Croce & Hein 2020b). APGD-
T (Croce& & Hein 2020b), FAB-T (Croce & Hein 2020ap, and Square (a black-box attack) (Andriushchenko
ct al. 2020).
4.4 PERFORMANCE EVALUATION
We present experimental results and comparisons various datasets using ResNet-18 and WideResNet- 34-10 architecturos. Specifically, results for CIFAR-10 on ResNet-18 and WideResNNet34-100 are summarized in Tables D and 2 respectively, while results for CIFAR-100, SVHN, and Tiny ImageNet using ResNet-18 are presented in Tables 3 and [ respectively. To further explore the versatility of the proposed method,
we evaluate using lightweight backbone, VGG-16 architecture (Simonyan & Zisserman, CIFAR-10 datasct. The results are presented in Table G
2014), on the
Additionally, comparisons with other prominent baselines provided in Table 7 Finally, we compare the perfomance of adversarial examples generated using the SDI metric approach described in Eq. 5 to adversarial examples crafted using cross-entropy and KL-divergence losses.
The experiments were corried out three times using different random seeds. The mean and standard deviation were then calculated, with the results presented as mean std.
4.4.1 Comparing AT and TRADES with their SDI-regularized variants.
In this comparison, evaluate the performance of AT and TRADES against their respective variants with the SDI regularization term, AT-SDI and TRADES-SD Experimental findings indicate that the proposed regularization term enhances robustness against various adversarial attacks, including Auloallacks and CW. Specifically, when applied to ResNet-18 and WideResNeet334110 architectures on CIFAR-10, AT- SDI demonstrates improvements over AT across all evaluated attacks (see Tables and 2). For example, on WideResNNet-34110, AT-SDI outperforms AT in robustness against PGD-20 (+0.45 %). CW (+2.54 %), and Autonttacks (+1.65 %). The improvement. in robustness are achieved without significant reduction in the natural accuracy.
Similarly, TRADES-SIN exhibits superior performance compared to TRADES on PGD-20 (+1.19 %), CW (+2.06 %), and Autoottacks (+1.14%). Training with TRADES-SDI also exhibit a noticeable improvement of 0.67 % on the natural accuracy. Overall, AT-SDI achieves greater improvement in robustness against CW allacks compared to TRADES-SDI, while TRA TRADES-SD) demonsttraes better enhancement against. PGD-20 attacks compared to AT across ResNet-18 and WideeResNet-34- 10 architectures.
The proposed SDI regularization term also enhances robustness CIFAR-100 when applied to ResNet-18 across all evaluated adversarial attacks (see Table 3)). The margin of improvement in robustness against adversarial attacks on CIFAR-100 appears to be larger than that observed on CIFAR-10 for both AT-SDI and TRADES-SDI. Similar improvements in robustness are observed when AT-SDI and TRADES-SD are utilized to train Resnet-18 on SVHN dataset. Results in Table (4) show that AT-SDI outperforms AT on CW (+5.23%), Autoattack (+ 1.20%), and PGD-20 (+2.43%)
Table also clearly shows that the proposed training objective improves the robustness of Resnet-18 against all the evaluated attacks Tiny Imagenet. The consistent improvement of performance across all the datasets tested validates the efficacy of the proposed SDI regularization term.
Finally, Table D demonstrates the effectiveness of the proposed training objectives on VGG-16 using the CIFAR-10 dataset. Incorporating the proposed LSDI regularization term into AT results in a marginal improvement in robustness PGD-20, with a significant gain of 3.14% against CW and 2.7% improvement against Autoottack. Similarly, TRADES-SD. surpasses TRADES with a 1.3% increase in robustness against PGD-20, 1.71% gain against CW, and 2.55% improvement against. Auloattack.
8

---

Published in Transactions on Machine Learning Research (12/2024)
Table 1: White-box attack robust accuracy for ResNet-18 on CIFAR-10.
DEFENSE
NATURAL
PGD-20
CW
AA
STANDARD-AT
84.10 c.p
52.78 i 0:30
51.80 = 0.14
17.95
AT SDI (Ours)
83.88 +: 0.10
53.43
0.0
53.71
0.00
49.56 = 6.07
TRADES
82.65 + 6.15
52.82
+ 0.13
51.82 = 0.18
48.96 + 0.11
TRADES SDI (Ours)
82.04 0.11
53.87 0.9
52.61
0.00
50.80
Table 2: White-box attack robust accuracy for Wideresnet-34-10 CIFAR-10.
DEFENSE
NATURAL
PGD-20
CW
AA
STANDARD AT
86.23
56.32 0.30
54.95 # 0.2
51.92
AT-SDI (Oon))
56.11 0.04
56.78 0.09
57.49 0.s
53.57 = 0.86
TRADES
84.70 = 0.19
56.30 0.16
54.51
0.11
53.07
= 0.13
TRADES-SDI (Ouis)
85.37 0.11
57.49
56.57
54.21
0.07
Table 3: White-bax attack robust accuracy for ResNet-18 on CIFAR-100.
DEFENSE
NATURAL
PGD 20
CW
AA
STANDARD-AZ AT
56,59 0:2
28.18 0.39
25.64 0.38
24.07 0.15
AT SDI (Ours)
57.96 2.1
30.78 : 0.12
29.37 = 0.15
26.38 = 0.10
TRADES
56.96 0.16
29.21
0.12
25.57
24.65
TRADES SDI (Ours)
60.68 + c.u
31.21 0.0
28.73 0.04
26.45 0.04
Table 4: Whito-box attack robustness accuracy for ResNct-18 on SVHN.
DEFENSE
NATURAL
PGD 20
CW
AA 45.95
STANDARD-AT
92.57
55.67 + 0.14
52.92
AT-SDI (Ouns)
92.10 0:20
58.10 0.20
58.15
0.05
47.15 + 0.05
TRADES
90.83 0.14
57.27 + 0.08
53.59
= 0.05
46.45 0.07
TRADES-SDI (Ouns)
90.54 0.07
59.21 0.30
56.39
0.30
49.21 0.05
Table 5: White-box attack robustness accuracy for ResNet-18 Tiny Imagenet.
DEFENSE
NATURAL
PGD - 20
CW
AA
STANDARD-AI
48.83 + 0.30
23.96 +
21.85
17.91
AT-SDI (Ours)
49.73 0.04
24.79 = 0.03
23.16 4 0.05
20.01 + Dos
TRADES
49. 11 +: 0.38
22.82
1 0.14
17.79 4 0.16
16.82 0.00
TRADES-SDI (Ours)
51.77 0.11
25.11
0.35
21.42 1 0.0
19.71 b.00
Table 6: White- box attack robust accuracy for VGG-16 on CIFAR-10.
DEFENSE
NATURAL
PGD
20
CW
AA
STANDARD-AT
78.76 cm
49.56 i:: 0.0
16.98 0.10
13.23 0.05
AT SDI (Ours)
78.69 i oor
49.67 :: 008
50.12 = 0.00
45.95
+ 0.05
TRADES
80.42 6.10
48.78 nor
46.48
43.96
TRADES SDI (Ours)
80.21 + 0.11
50.08 + 0.00
48.19 0.00
46.51
+ 0.08
4.4.2 Comparison with other prominent baselines.
Here, we compare our approach with other prominent and stato-of-tho-art methods from existing works, including MART (Wang el al. 2019), adversarial weight verturbation (AWP) (Wu et al. 2020), ST-AT Li et al.) 2023). LAS AT (Jia et al. 2022). LOAT (Yin & Ruan 2024) and Randomize- AT (Jin et al. 2023). Additionally, for fair comparison with A AWP, we combine AT-SDI and TRADES-SD with AWP and denote them as AT-SDI + AWP and TRADES-SIE SDI + AWP, respectively. In both AT-SDI + AWP and TRDDESSDD + AWP, the SDI regularization term is employed for perturbing the network weights.
9

---

Published in Transactions on Machine Learning Research (12/2024)
Experimental results displayed in Table 7 show that AT-SDI outperforms all existing basclines in robustness against, CW attacks. Additionally, AT-SDI outperforms TRADES and MART against. Auloatlacks. How- ever, AT-SDI slightly underperforms compared to MART against PGD-20. Furthermore, AT' + AWP also marginally outperforms AT-SDI against Autoattacks. On the other hand, TRADES-SDI achioves better performance than all baselines on CW and Autoutlacks.
When compared recent state-of-the-art methods, AT-SDI and TRADES-SDI demonstrate superior per- formance CW and SPSA attacks. TRADES-SDI outperforms LAS AT on CW (+0.82%), Auto-attacks (+0.66%), and SPSA (+ 1.1%). Although LOAT moderately performs better than AT-SDI and TRADES- SDI on PGD-20, both methods show significantly better than LOAT against CW, AA, and SPSA. While Rondomize AT' and CAT slightly surpass AT-SDI and TRADES-SDI on PGD-20, AT-SDI and TRADES- SDI perform better on CW and SPSA attacks. Moreover, Randomize AT and CAT take roughly twice as long to train, making AT-SDI and TRADES-SDI significantly more efficient.
Combining our approach with AWP further improves robustness against the evaluated attacks. Specifically, AT-SDI AWP and TRADES-SD. SDI + AWP outperform AWP + AT and TRADES AWP against every adversarial attack. AT-SDI + AWP and TRADES- SDI + AWP demonstrate improved performance across all attacks. AT-SDI + AWP enhances robustness to PGD-20, CW attacks, and Autoattacks over AWP by 2.11%, 4.38%, and 2.79%, respectively. AT-SDI+ also considerably outperforms AWP robustness against SPSA, a strong query-based blackbox attack, by 2.99%. Additionally, AT-SDI + AWP achieves superior performance on natural samples. TRADES-SD. + AWP improves performance over AWP on all the attacks but dips by 0.15% in performance on natural examples.
Table 7: Comparison with other state-of-the-art baselines under whitte-bxx and black- box attacks CIFAR- 10 for Wideresnet-34-10.
DEFENSE
NATURAL
PGD-20
CW
AA
SPSA
STANDARD AT
86.23
56.32
54.95
0.12
51.92 + 6.09
61.05
TRADES
84.70 0.19
56.30 i: 0.16
54..1 : o.1
53.07 1 c.15
61.15 0.88
MART
84.17 0.06
58.10 i: 0.35
54.51 = 0.00
51.11 1 cor
58.91 i: 0.00
MAIL (OLIU ET AL.
2021
86.81
60.49 0.3
51.45 0.11
47.11 + 6.18
59.25 1007
ST-AT CLL ET AL.
2023
84.91 0.09
37.52 = 0.00
55.11 = 0.05
53.54 +: 0.05
61.34 1.0
LAS-AT JIA ET AL.
2022
86.23
56.50
55.75
0.13
53.55
6.09
61.21
RANDOMIZE JIN ET AL.
2023
85.99 0.12
58.41 + 0.10
56.14 + 0.14
54.15 + 6.11
61.59 + D00
CAT LIU ET AL. (023
86.24
57.51 0.14
55.93
0.18
54.
6.18
61.37
LOAT VIN & RuAN 20244)
84.17 + 0.19
58.67 1: 0.12
55.70 = 0.09
52.35
1: 0.05
60.27 1: 0.10
AT-SDI (OURS)
86.11
56.78
0.07
57.49
0.06
53.57
62.46 D.6G
TRADES-SDI (OURS)
85.37 0.11
57.49 0.36
56.57 = 0.11
54.21
62.31 0.66
AT-SDI + AWP (oURs;
88.21 :: 0.06
60.15 1: 0.06
60.30 0.05
56.71
+ 0.06
65.56 + 0.04
TRADES-SDI + AWP (OURS)
85.21
60.72
58. 0.07
56.82
0.05
63.41 n.06
Table 8: Comparison with herer baselines under white-box and black-box attacks on Tiny Imagenet for
18.
DEFENSE
NATURAL
PGD-20
CW
AA
SPSA
STANDARD AT
48.83
23.96 +
21.85 am
17.91
26.93
TRADES
49.11 + 021
22.82 + cas
17.79 + 02a
16.82 0.20
27.41 0.15
MART
16.01 n.r
26.03 cm
22.08 + aay
19.18 = 0.09
28.15 0.08
MAIL (OLIU ET AL.
2021
49.72 0.11
21.09 + 0.2
21.21 0.23
17.42 0.19
26.68 0.15
ST-AT LL ET AL.
2023
48.61 4 0.08
23.85 4 e:
18.43 4 8.10
17.29 = 0.00
27.91 0.08
AWP ( [WU ET AL.
2020
48.89 0o0
24.97 6.1
22.39 4 om
18.68 0.17
28.22 0.10
AT-SDI (OURS)
49.73 à: 0.10
24.79 + c.0s
23.16 4 u.a
20.01 - 0.06
28.95 0.09
TRADES-SDI
51.77
25.11
21.42 0.4
19.71
28.36
AT-SDI + AWP (OURS)
50.12 + 0:27
26.14 0.16
24.27 + b.18
20.47 = 0.11
29.07 0.12
TRADES-SDI + AWP (OURS)
52.87 + 0:28
25.56 6.17
23.59 0.14
19.83 0.15
28.41 0.11
'It takes approximately twice as much time to train compared to our methods.
10

---

Published in Transactions on Machine Learning Research (12/2024)
4.4.3 SDI-regularization Improves Generalization of Adversarial Training.
Most AT methods involve training with a specific type of adversarial examples crafted by maximizing either the cross-entropy or KL-divergence measure using PGD. Therefore, the adversarial examples utilized for adversarial training do not entirely reflect the universe of all possible adversarial attacks that a robust model may encounter. This limitation can lead to poor generalization of adversarially trained models to other types of adversarial examples (Song et al. 2018).
Typically, adversarial training methods exhibit significantly higher performance on PGD attacks, as evident from the experimental results tables. However, when subjected to other types of attacks, the performance of robust models tends to diminish. For example, it can be observed from the tables that the robust accuracy on CW and AA attacks are notably lower compared to PGD-20.
The introduction of the LSDI regularization term to the standard AT and TRADES improves their per- formancos against other attacks. Unlike other AT methods, AT-SDI considerably improves the robustness against CW and AA on all the datasels evaluated. In fact, training a model using the proposed AT-SDI consistently improves the performance of the resulting robust model to CW attack and achieve better per- formance over PGD-20 on CIFAR-10 dataset, as may be obscrved Tables I 2 and 7 Note that CW adversarial examples are not used for training, yet better robust accuracies are recorded compared to PGD adversarial examples, which are typically used for adversarial training. Significant improvement in robustness against CW and AA can also be observed on other datasets, CLFAR-100, SVHN, and Tiny Imagenet. The SDI regularization term also improves the performance of TRADES on CW and AA attacks. Experiments in Tables 1 show that the SDT regularization reduces the performance gap between PGD-20 and the other attacks.
Combining AWP (Wu el. al., 2020) with AT-SDI achieves a high robustness of 60.30% on CW, improving AWP by 4.38% on CIFAR-10 10. Further, the robustness performance on CW is better than the robustness performance on PGD-20. Also in Table 7. the improvement in performance is noticcable against AA and SPSA attacks. Similarly, the improvements in robust.ness to CW AA can be observed in Table 7 when the LSDI regularization is applied to TRADES + AWP.
Overall, the proposed LSDI regularization term consistently minimizes the performance gaps between robust- ness to PGD-20 adversarial examples and other lypes of adversarial examples. This supports our argument that the LSDs regularization improves the generalization of adversarial training- An intuitive explanation for this observation is that the Lspr regularization is not dependent on the specific algorithmic nuances of individual adversarial attacks and defenses. Instead, it explicitly maximizes the probability gaps between the probability of the true class of each adversarial example and the probabilities corresponding to incorrect classes.
4.4.4 Sensistivity Analysis of the
3
Here, we study the influence of the regularization hyper-parameter on AT SDI and TRADES-SDI performance.
We trained Ned-R-e.Net-34410 using AT-SDI with B values of 1.0, 2.0, 3.0, 4.0, and 5.0, and TRADES- SDI with 8 values of 1.0, 2.0, 2.5, 3.0, 4.0, and 5.0. We present the results in Tables 9 and 10 which shows that increasing the value of 3 leads to moderate reduction in the natural accuracy of AT-SDI and TRADES-SDI The robust accuracy of PGD-20 remains relatively stable for various values of on AT-SDI and TRADES-SDL Nevertheless, AT-SDI exhibits noticeable improvement in robustness against CW attack 3 increases. The performance of AT-SDI against Autoattack also improves with increasing 3 value but diminishes as 3 gets too large. We selected / = 3.0 since it maintains a good balance between the natural and robust accuracy.
Like AT-SDI, TRADES-SD. SDI is also sensitive to B. The variations in natural accuracy are moderate when B is varied. The robustness to PGD-20 remains relatively stable as 3 varies. It can be obscrved from [0 that the robust performance on CW attack and AA increases as B increases, but both decrease slightly when B is set to 5.0.
11

---

Published in Transactions on Machine Learning Research (12/2024)
Table 9: Sensitivity analysis on 3 on AT-SDI for Wideresnet-3ee 34-10 on CIFAR-10.
B
NATURAL
PGD-20
CW
AA
1.0
86.75
56.772a07
57.07...0
53.16
13.161a08
2.0
86.52 22.52
56.84+207
57.19
53, 4440.0
3.0
86.11amo
56.78
57.49
53.57 2..0s
4.0
85.78+aa1
+6.6
57.49
53.39+0m0
5.0
85.59+n.0
56.37+aup
57.81+n.e
52.73+ouu
Table 10: Sensitivity analysis on 3 on TRADES-SDI for Wideresnet-34-100 on CIFAR-10.
B
NATURAL
PGD-20
CW
AA
1.0
57.27
a5.6
53.43+t.10
2.0
85.43
57.29
56.01
53.61
2.5
85.392mm
57.362015
56.28 2
53. 88100p
3.0
85. 37 =0.1
57.49+a16
56.57
21 +0.07
4.0
85. 2013
57.33
56.664a.1
54. 1100000
5.0
85.21 +o.1
57.31+au
56.59
54.05
4.4.5 Computational Cost
We conducted all experiments using a single core of an AMD EPYC 7513 processor, an Nvidia A100 SXM4 80 GB GPU, and 128 GB of RAM. When the proposed LSDI regularization term is added to AT, increases the training time per epoch by more than 4 seconds for ResNet-18. For context, popular regularization losses like KL-divergence and mean square error add up to 8 seconds and 10 seconds per epoch, respectively, under similar conditions and computational resources. Therefore, the Lsnr regularization is lightweight and introduces minimal overhead compared to KL divergence and mean square error losses.
Algorithm SDI-PGD Algorithm.
Input: a neural network model with the paramcters 0, step size n, natural examples x, in a labelled
dataset D of size n and |C| is the number of classes.
Output: Adversarial examples x
1: Sample (x,, v.) from D;
x; f x; + 0.001 A/(0, 1);
(O, T) is Gaussian distribution with zero mean and identity variance.
3: for t= 1 to '' do
b T is the number of PCD iteration steps.
4: MsDr(x(,B::) (1 (llx(i 1o(x(), 30.5
-
5:
I1 - sign( V (x) v1:
b II denotes the projection operator.
end for 7: return x
Return adversarial example.
4.5 ADVERSARIAL ATTACK USING THE SDI METRIC
In Section we argue that the proposed SDI metric in Eq. 3 can be utilized for crafting adversarial examples.
Here, compare PGD-based adversarial examples optimized using the SDI metric with existing popular PGD-based adversarial examples crafted using information-theorcti measures such as cross-cntropy (Madry et al. 2018) and KL-divergence (Zhang et al. 2019h. The Mssn--nesuur-opliinie adversarial examples are crafted using the approach described in Eq. 55. We compare the performances of each approach under AT and TRADES. each case, the attack obtained using the conventional attack settings: 20 PGD iterations, perturbation bound e 0.031, and step size 0.003. The algorithm for obtaining adversarial examples using the Mypt measure is provided in Algorithm
12

---

Published in Transactions on Machine Learning Research (12/2024)
Natural CIFAR-10 Images
ship
doet
10190
shpp
dog
Corresponding Perturbations, 8/255
Corresponding Perturbations, = 0.2
Adversarial Examples,
deer
cat cat dog
airplane
horse
Figure 1: Comparison of natural CIFAR-10 images with the adversarial perturbations and adversarial ex- amples obtained by SDI-PGD attack defined in Eq. ( Images in the first row represent natural CIFAR-10 images and their correct labels. The second and third rows represent the corresponding L adversarial per- turbations, with 8/255 and 0.2 respectively. The fourth row represents the corresponding adversarial examples and their incorrect labels for each image in row one.
We display some adversarial examples obtained using the proposed MsDI maap-mmmaurr--piimizee approach and their corresponding misclassified labels in the last row of Figure Additionally, we display the corresponding adversarial perturbations of the original images in rows two and three.
We compare the robustness of two prominent adversarial training variants, AT and TRADES, against PGD- basod adversarial examples generated using cross-entropy loss, KI-divergence, and the SDI measure. The experimental results are presented in Table [I is evident from the table that adversarial examples crafted using the SDI metric exhibit significantly greater strength compared to those crafted using KI-divergence.
13

---

Published in Transactions on Machine Learning Research (12/2024)
Nevertheless, adversarial examples generated with the cross-entropy loss demonstrate a marginally greater strength than those obtained using the proposed SDI metric.
The results show that the SDI metric produces 'useful gradients' for generating adversarial examples, a desirable quality as discussed in prior studies (Athalye et al. 2018 Papernot et al. 2017p. This suggests that optimizing the SDI metric for improving adversarial robustiness would not lead to gradient obfuscation (Athalye al. 2018
Table 11: Comparison of successes of PGD attacks crafted using cross-entropy, KL-divergence, and SDI measure on defences AT (Madry et al. 2018 and TRADES 18.
Zhang et al. 2019 on CIFAR-10 for Resnet-
PGD ATTACK MRASURE
AT
TRADES
CROSS-ENTROPY
52.78 0.10
52.82 6.12
KI-DIVERGENCE
68.03 0.15
68.87 1: a1
SDI
53.95 0.14
54.32 :: 0.9
5 CONCLUSION
We introduce novel regularization term based on standard deviation-inspired (SDT) measure to improve adversarial robustness. The SDI measure captures the spread of model's estimated probabilities with respect lo the true class of each input. We establish a connection between optimizing the SDI measure and the min-max optimization procedure in adversarial training. Specifically, we illustrate that the SDI measure may be optimized for generating adversarial examples by socking perturbations that minimize the SDI measure.
We demonstrate with experimental study that maximizing the SD1 measure adversarial training examples contributes to improving the robustness of existing adversarial training methods. Empirical results indicate that the proposed regularization significantly improves existing adversarial training variants' robustness and generalization capabilities.
References
Maksym Andriushchenko and Nicolas Flammarion. Understanding and improving fast adversarial training. Advances Noural Information Processing Systems, 33:16048-16059, 2020.
Maksym Andriushchenko, Francesco Croce, Nicolas Flammarion, and Matthias Hein. Square attack: query-effciient black-box adversarial attack via random search. In Europcan Conference on Computer Vision, pp. 484-501. Springer, 2020.
Philippe Artzner, Freddy Delbaen, Jean-Mare Eber, and David Heath. Coherent measures of risk. Mathematical finance, 93):2003 228, 1999.
Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give a false sense of security: Circunventing defenses to adversarial examples. In International Conference on Machine Learning, pp. 274-283. PMLR, 2018.
Jacob Buckman, Aurko Roy, Colin Raffel, and lan Goodfellow. Thermometer encoding: One hot way to resist adversarial examples. In International Conference on Learning Representations, 2018.
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp), pp. 39-57. IEEE, 2017.
Francesco Croce and Matthias Hein. Minimally distorted adversarial examples with a fast adaptive boundary allack. In International Conference Machine Learning, pp. 2196 22052 PMLR, 2020a.
Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In International Conference Machine Learning, pp.
PMLR, 2020b.
14

---

Published in Transactions on Machine Learning Research (12/2024)
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In 2009 IEFE conference computer vision and pattern recognition, pp. Teee, 2009.
Guneet Dhillon, Kamyar Azizzadenesheli, Zachary C Lipton, Jeremy Bernstein, Jean Kossaifi, Aran Khanna, and Anima Anandkumar. Stochastic activation pruning for robust adversarial defense. arXiv preprint arXiv:1803.01442 2018.
Logan Engstrom, Andrew Nyya, and Anish Athalye. Evaluating and understanding the robustness of adver- sarial logit pairing. arXiv preprint arXiv:1807. 10272, 2018.
Olukorede Fakorede, Ashutosh Nirala, Modeste Atsague, and Jin Tian. Improving adversarial robustness with hypersphere embodding and angular- based regularizations. In ICASSP 2023-2023 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 1-5. IEEE, 2023a.
Olukorede Fakorede, Ashutosh Kumar Nirala, Modeste Atsague, and Jin Tian. Vulnerability-awee aware instance reweighting for adversarial training. Transactions on Machine Learning Research, 2023b.
Olukorede Fakorede, Modeste Atsague, and Jin Tian. Improving adversarial training using vulnerability- aware perturbation budget. arXiv preprint arXiv:2403.0407, 2024.
Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6372, 2014.
Chuan Guo, Mayank Rana, Moustapha Cisse, and Laurens van der Maaten. Countering adversarial images using input transformations. In International Conference on Learning Representations, 2018.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 770 778, 2016.
John Hull. Risk management and financial institutions,+ Web Site, volume 733. John Wiley & Sons, 2012.
Xiaojun Jia, Yong Zhang, Baoyuan Wu, Ke Ma, Jue Wang, and Xiaochun Cao. Las-at: adversarial training with learnable attack strategy. In Proceedings of the LEEE/CVE Conference on Computer Vision and Pattern Recognition, pp. 134088 2022.
Gaojie Jin, Xinping Yi, Dengyu Wu, Ronghui MU, and Xiaowei Huang. Randomized adversarial training via taylor expansion. In Proceedings of the IEEE/CVT Conference Computer Vision and Pattern Recognition, pp. 16447-16457, 2023.
Sekitoshi Kanai, Masanori Yamada, Shin'ya Yamaguchi, Hiroshi Takahashi, and Yasutoshi Ida. Constraining logits by bounded function for adversarial robustness. 2021 International Joint Conference on Neural Networks (LJCNN), pp. 1-8. IEEE, 2021.
Harini Kannan, Alexey Kurakin, and Ian Goodfellow. 105v:1803.0663 2018.
Adversarial
logit pairing.
arxiv preprint
Vladimir Koltchinskii and Dmitry Panchenko. Empiriaal margin distributions and bounding the generaliza- tion error of combined classifiers. The Annals of Statistics, 30(1):1 50, 2002.
Alex Krizhevsky al. Learning multiple layers of features from tiny images. 2009.
Hyungyu Lee, Ho Bae, and Sungroh Yoon. Gradient masking of label smoothing in adversarial robustness. IEEE Access, 9:6453-6464, 2020.
Pengcheng Li, Jinfeng Yi, Bowen Zhou, and Lijun Zhang. Improving the robustness of deep neural networks via adversarial training with triplet loss. arXiv preprint arXiv:1905.11713 11713, 2019.
Qizhang Lí, Yiwen Guo, Wangmeng Zuo, and Hao Chen. Squeeze training for adversarial robustness. 2023.
15

---

Published in Transactions on Machine Learning Research (12/2024)
Feng Liu, Bo Han, Tongliang Liu, Chen Gong, Gang Niu, Mingyuan Zhou, Masashi Sugiyama, et al. Proba- bilistic margins for instance reweighting in adversarial training. Advances in Neural Information Processing Systems, 34:23258 23269, 2021.
Xingbin Liu, Huafeng Kuang, Xianming Lin, Yongjian Wu, and Rongrong Ji. Cat: Collaborative adversarial training. arXiv preprint MIXiv:2303.1992 2023.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations, 2018.
Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, and Pascal Frossard. Deepfool: a simple and accurate method to fool deep neural networks. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 2574-2582, 2016.
Marius Mosbach, Maksym Andriushchenko, Thomas Trost, Matthias Hein, and Dictrich Klakow. Logit pairing methods can fool gradient-based attacks. arXiv preprint arXiv:1810.12044 2018.
Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Bo Wu, and Andrew Y Ng. Reading digits in natural images with unsupervised feature learning. 2011.
Tianyu Pang, Xiao Yang, Yinpeng Dong, Kun Xu, Jun Zhu, and Hang Su. Boosting adversarial training with hypersphere embedding. Advances in Neural Information Processing Systems, 33:7779-7792, 2020.
Nicolas Papernot, Patrick McDaniel, Somesh Jha, Matt Fredrikson, Z Berkay Celik, and Ananthram Swami. The limitations of deep learning in adversarial settings. Tn 2016 TEEE European symposium on security and privacy (EuroS&P), pp. 372 387. IEEE, 2016.
Nicolas Papernot, Patrick McDaniel, Ian Goodfellow, Somesh Jha, 7 Berkay Celik, and Ananthram Swami. Practical black-box attacks against machine learning. In Procoedings of the 2017 ACM on Asia conference on computer and communications security, pp. 506-30 519, 2017.
Vyas Raina, Samson Tan, Volkan Cevher, Aditya Rawal, Sheng Zha, and George Karypis. Extreme miscal- ibration and the illusion of adversarial robustness. arXiv preprint 1xXiv:2402.17099) 2024.
Stephen Ross, Jeffrey Jafle, and Ram Kumar Kakani. Corporate Finance, 10e. McGraw-Hill Education, 2019.
Ali Shafahi, Amin Ghiasi, Mahyar Najibi, Furong Huang, John P Dickerson, and Tom Goldstein. Batch-wise logit-similarity: Generalizing logit-squeczing and label-smoothing. In BMVC, pp. 72, 2019a.
Ali Shafahi, Mahyar Najibi, Mohammad Amin Ghiasi, Zheng Xu, John Dickerson, Christoph Studer, Larry S Davis, Gavin Taylor, and Tom Goldstein. Adversarial training for free! Advances in Neural Information Processing Systems, 32, 2019b.
Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. arXiv preprint 14XXv:1109.11. 2014.
Chuanbiao Song, Kun He, Liwei Wang, and John E Hopcroft. Improving the generalization of adversarial training with domain adaptation. In International Conference on Learning Representations, 2018.
Cecilia Summers and Michael J Dinneen. Improved adversarial robustness via logit regularization methods. arXiv preprint 15ii:1906003749 2019.
Christian Szegedy, Wojeiech Zaremba, Tlya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199, 2013.
Jonathan Uesato, Brendan O'donoghue, Pushmect Kohli, and Aaron Oord. Adversarial risk and the dangers of evaluating against weak attacks. In International Conference on Machine Learning, pp. 5025-5034 PMI.R, 2018.
16

---

Published in Transactions on Machine Learning Research (12/2024)
Yisen Wang, Difan Zou, Jinfeng Yi, James Bailey, Xingjun Ma, and Quanquan Gu. Improving adver- sarial robustness requires revisiting misclassified examples. In International Conference on Learning Representations, 2019.
Eric Wong, Leslie Rice, and Zico Kolter. Fast is better than free: Revisiting adversarial training. arXiv preprint arXiv:2001.03994, 2020.
Dongxian Wu, Shu- Tao Xia, and Yisen Wang. Adversarial weight perturbation helps robust generalization. Advances in Neural Information Processing Systems, 33:2958-2968 2020.
Xiangyu Yin and Wenjie Ruan. Boosting adversarial training via fisher-rao norm-based regularization. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 24544-24553, 2024.
Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theo- retically principled trade-off between robustness and accuracy, In International Conference on Machine Learning, pp. 7472 7482. PMLR, 2019.
Jianfu Zhang, Yan Hong, and Qibin Zhao. Memorization weights for instance reweighting in adversarial training, In Proceedings of the AAAI Conference on Artificial Intelligence, volume 37, pp. 11228 1 11236, 2023.
Jingfeng Zhang, Jianing Zhu, Gang Niu, Bo Han, Masashi Sugiyama, and Mohan Kankanhalli. Geometry- aware instance-reeeighted adversarial training. In International Conference Learning Representations. 2020.
Jingfeng Zhang, Jianing Zhu, Gang Niu, Bo Han, Masashi Sugiyama, and Mohan S Kankanhalli. Geometry- aware instance-reweighteed adversarial training. In ICLR, 2021.
17


Reviews:
[{"review_id": "wADsHomzea", "reviewer": "Reviewer_K7kB", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Pros)\n+ This paper is well-written and relatively easy to follow.\n+ A straightforward metric, known as the standard deviation-inspired (SDI) measure, could lead to performance improvements across various datasets and threat models.\n\nCons)\n- Lack of intuition and insight into why SDI would be effective, and I remain unconvinced that SDI brings significant advantages to adversarial training. Could the authors provide more detailed explanations or insights to support this?\n- The notations are slightly confusing. Eq.(5) utilizes $M_{SDI}$ as the inner loop for the formulation of adversarial examples, but Algorithm 1 presents instead using $L_{CE}$ (at line 7). This stems from confusion between the proposed formulation in Section 3.2 and the regularization introduced in Section 3.3. \n- The experimental results are somewhat limited. While ResNet-18 and WideResNet-34-10 are commonly used backbones in the field for comparison, relying solely on them restricts the analysis. I believe that evaluating the proposed method with larger or more lightweight backbones could provide additional insights and would demonstrate further benefits over other approaches.\n- (Minor) Some \"inner\" and \"outer\"s are misused (likely due to mistakes), but they should not be.\n- This paper could be stronger if it includes comparisons with existing adversarial training methods [1, 2, 3, 4], as there is currently limited comparison with competing approaches.\n\n  [1] LAS-AT: Adversarial Training with Learnable Attack Strategy, CVPR 2022\n\n  [2] CAT: Collaborative Adversarial Training, arxiv 2023\n\n  [3] Randomized Adversarial Training via Taylor Expansion, CVPR 2023\n\n  [4] Boosting Adversarial Training via Fisher-Rao Norm-based Regularization, CVPR 2024\n\nFurther comments)\n- I am still curious how such a simple metric would function as a regularizer with universality. If the data modality is not singular (I mean, there could be many clusters in each class), can the authors guarantee the effectiveness of the proposed metric?\n- Could you elaborate on why the multi-class margin term should be included in the formulation in eq.(6)?\n- Can the authors provide more results with other backbones over WideResNet, such as ResNet-18, and datasets like Tiny-ImageNet in Table 6?", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper introduces a standard deviation-inspired (SDI) regularization term for adversarial training (AT) to improve adversarial robustness and generalization. Inspired by the concept of the standard deviation that quantifies the data points' dispersion, the authors use the standard deviation as a regularizer at the outer loop. Experimental results demonstrate that combining SDI with existing AT variants strengthens defenses against advanced attacks like CW and AutoAttack, while also improving robust generalization. The paper offers compelling improvements based on the standard AT approaches like TRADES.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "See the above comments.", "broader_impact_concerns": "This paper does not appear to present any ethical concerns.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "AXey6vDzO5", "reviewer": "Reviewer_7832", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n\t1. Novel approach: The SDI measure provides a new perspective on adversarial robustness, complementing existing methods.\n\t2. Comprehensive empirical evaluation: The authors test their method across multiple datasets, model architectures, and attack types.\n\t3. Improved performance: Consistent improvements in robustness are demonstrated, especially against attacks like CW and Auto-attack.\n\t4. Generalization: The method shows better generalization to unseen attacks compared to baseline methods.\n\t5. Compatibility: The SDI regularization can be easily integrated with existing adversarial training techniques.\nWeaknesses:\n\t1. Lack of theoretical guarantees: While the empirical results are strong, the paper lacks rigorous mathematical proofs for the conceptual similarities claimed.\n\t2. Computational cost: The paper doesn't thoroughly discuss the additional computational overhead of the SDI regularization.\nHyperparameter sensitivity: The impact of the β hyperparameter is shown, but guidelines for optimal selection are not provided.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper proposes using standard-deviation-inspired (SDI) regularization term to improve adversarial robustness and generalization in deep neural networks. The main contributions are:\n\t1. Proposal of the SDI measure as a regularization term, which quantifies the dispersion of a model's output probabilities relative to the true class probability. For an input-label pair $(x\\_i, y\\_i)$, the SDI measure is defined as:\n$M\\_{SDI}(x\\_i, y\\_i, θ) = \\sqrt{\\Sigma\\_{k=1}^{|C|} (f\\_θ(x\\_i)\\_k - f\\_θ(x\\_i){y\\_i})^2) / (|C| - 1)}$\nwhere $f\\_θ(x\\_i)\\_k$ is the model's estimated probability for class $k$, and $f\\_θ(x\\_i)_{y\\_i}$ is the probability for the true class.\n\t2. Argumentation that minimizing SDI is conceptually similar to the inner maximization step in adversarial training, while maximizing SDI aligns with the outer minimization step.\n\t3. Demonstration that the SDI measure can be used to generate adversarial examples. For example, the AT-SDI objective is formulated as: $\\Sigma\\_i L\\_{CE}(f\\_θ(x'\\_i), y\\_i) - \\beta \\cdot L\\_{SDI}(x'\\_i, y\\_i, \\theta)$\nwhere L_CE is the cross-entropy loss, x'_i are adversarial examples, and β is a hyperparameter controlling the strength of the regularization.\n\t4. Empirical evidence showing that incorporating the SDI regularization term into existing adversarial training methods (AT and TRADES) improves robustness against attacks like CW and Auto-attack.\n   5. Demonstration of improved robust generalization, particularly for attacks not seen during training.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "Critical:\n\n\t1. Does the argument on alignment of SDI measure with minimization and maximization hold only when the maximum probability class is the true class? Please clarify.\n\n\t2. Two of the main claims seems to be slightly contradictory: (1) you argue that SDI measure minimization and maximization aligns with minimization and maximization of AT and that (2) SDI is non-information-theoretic (what does that precisely mean?) and hence orthogonal to usual information theoretic loss in AT. Please clarify why this is not contradictory or resolve this. \n\n\t3. Include discussion on the computational overhead of the proposed method.\n\nBeneficial but not critical:\n\n\t1. Provide a more rigorous theoretical analysis of the relationship between SDI and existing adversarial training objectives.\n\n\t2. Provide guidelines or heuristics for selecting the optimal β value for different scenarios.\n\n\t3. Explore the potential of SDI in other machine learning tasks beyond adversarial robustness.", "broader_impact_concerns": "The paper doesn't explicitly discuss broader impact concerns. A broader impact statement could be added discussing:\n\nPotential positive impacts: Improved adversarial robustness could lead to more reliable and secure AI systems in critical applications.\n\nPotential negative impacts: This technique could potentially be used to create more robust adversarial examples.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "e02hhjgrwZ", "reviewer": "Reviewer_d1mo", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "**Strengths**: \n\nS1. The paper is mostly very well-written and structured. It is coherent and straightforward to follow and understand. \n\nS2. The proposed regulariser is easy to interpret and has a natural meaning for adversarial training. \n\n**Weaknesses**:\n\nW1. In the abstract, there is a sentence explaining that AT is un-targeted. This doesn’t seem particularly important for the paper to be pointed out in the abstract. I think a mention in the introduction would suffice. \n\nW2. In the contributions: “we argue … “ is not a proper contribution. The contribution is the second part, which is “experimentally show …”. \n\nW3. The paper doesn’t have a clear and organised literature review. It’s partly in the introduction and Section 2 which only mentions AT works. More importantly, the purpose of a literature review is to identify the research gaps to better motivate and position your work. At the very least, the authors should point out that the current AT methods still need improvement. \n\nW4. In Section 2.3, the standard deviation is a basic and known statistic, and in my opinion, it doesn’t need two paragraphs with examples to explain.  Instead, it is better to add more details about Fakorede et al. 2024, since your paper is built on that.  \n\nW5. In section 3.2, the fourth paragraph: “this observation suggests that …” is not a correct conclusion. I argue the contrary, i.e., minimizing SDI can yield one set of adversarial examples. But, it doesn’t necessarily mean that AT generates adversarial examples in the direction of minimizing SDI.  It might be the case under the $f_{\\theta}(x_i)y > max_{k,k\\neq y}f_{\\theta}(x_i)_k$ constraint, but that needs to be proven. \n\nW6. In section 3.3, the second paragraph claims that the introduced $M_{SDI}$ metric possesses favourable attributes. However, these attributes are not identified or explained anywhere in the paper. There are mentions that SDI is not an information-theoretic measure like cross-entropy, but this alone is not a useful feature of SDI. \n\nW7. In Algorithm 1, add \\beta to the Input arguments. \n\nW8. In section 4.1.2, explain the model selection procedure. Since \\beta trade-offs accuracy and robustness, which one is the priority for the hyperparameter tuning? For example, in section 4.4.4 you say “We selected $\\beta=3$ since it maintains a good trade-off between natural and robust accuracy”. How do you define “goodness”?\n\nW9. Tables 7 and 8 captions say ablation studies while they’re not actually ablations. Sensitivity analysis makes more sense. \n\nW10. In section 4.5, move Algorithm 2 and the relevant descriptions to Section 3. Also, can you elaborate on the last paragraph? What does ‘useful gradients’ mean, and how does SDI optimisation prevent gradient obfuscation? \n\nW11. In general, the results show that the introduced regulariser (Tables 1 to 5) can only marginally improve the robustness in terms of accuracy (by less than 1% or 2%).  Could the authors think of any other aspects that SDI can help with? Or maybe some AT methods than SDI can significantly improve?", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "No", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The paper introduces a regularisation term to the previous “Adversarial Training (AT)” methods to improve robustness. The regulariser is based on a constrained standard deviation that measures the dispersion of the probabilities assigned to the incorrect class with the probability of the correct class.  AT methods are usually a bi-level min-max optimisation and the proposed regulariser is only applied to the outer optimisation.", "claims_and_evidence_yn": "No", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "Please make changes according to my previous comments.", "broader_impact_concerns": "None", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: The paper is easy to follow, the proposed method is simple, and experimental results show the benefits of the proposed method. All 3 reviewers recommend acceptance. Reviewers asked for clarification of the intuition and motivation of the SDI measure, experiments (certain baselines such as https://arxiv.org/abs/2303.10653 https://arxiv.org/abs/2403.17520, and computational comparisons, hyper-parameter selection), and also discussions about similar regularization-based approaches such as https://arxiv.org/abs/2010.02558 and https://arxiv.org/abs/1906.03749. The authors have provided a response to each one along with additional experimental results, and most of them have been incorporated into the updated version of the paper. I request the authors to further include the discussions about similar regularization-based approaches, which was provided during the discussion phase.

Some other suggestions: There is a period in the name of section 2.2 which can be removed. $\boldsymbol{\mathrm{N}}$ (after eq3) and $\boldsymbol{\mathrm{L}}$ (after eq4) seems different from the font within the equation. I would be more comfortable if the authors do not remove the standard deviations in the experimental results, and would be better if it is added back to the tables. In Table 8, bold number for each column is missing. One of the reviewer suggests the following in the final recommendation (which I believe is not visible to the authors): "However, my remaining concern is that the intuition can be still presented more straightforwardly. For example, though the authors explain "why SDI would be effective" in Sections 3.2 and 3.3, I believe conveying it as a simple and clear message could draw more attention to this paper."
Decision: Accept (poster)