# Adversarial Training Methods for Deep Learning: A Systematic Review
## 2 Background
### Adversarial Training  
The concept of adversarial training involves training the classifier to generalize the adversarial samples as well as clean samples ([PERSON] et al., 2016).  
In the conventional training schema, shown in Figure 1, the training data pass forward through the model, and prediction loss is backpropagated to improve the classification results ([PERSON] et al., 2016). As a result, the model will generalize the distribution of the training data to produce an accurate prediction of their labels. However, a model trained with this normal procedure will be exposed to the threat of adversarial attacks ([PERSON] et al., 2016). Adversarial samples were described as linear properties of neural networks by [PERSON] et al. (2016). The more general explanation is that the model will only be able to generalize the training data distribution rather than capture the real distribution due to its linearity.  
Adversarial training expands on conventional training methods by adding an extra step into the training procedure, as illustrated in Figure 2. In this way, the model can generalize both clean data and the adversarial data generated by the attack methods utilized in the adversarial training. Therefore, the robustness of the model is improved against adversarial attacks.  
Figure 1: Conventional training of neural network model.  
Usually, the adversarial samples are generated based on the model's current state, whereas the latter is based on the previous batch of training steps [3] for any proposed attack method. However, some schemas use a pre-trained model to generate adversarial samples and include them in the training datasets [17]. In this procedure, the attack method involved in the adversarial sample generation will be the focus of this paper. Throughout the paper, we refer to them as the adversarial sample generation method or simply the adversary generator. More details are discussed in Section 4.  
Several popular adversarial training methods are also discussed here to provide better context for the general historical development of adversarial training. In 2014, [PERSON] et al. [4] proposed the concept of using adversarial samples to train classifier models in order to improve their robustness. Later, in 2015, [PERSON] et al. [3] suggested using the FGSM to generate an adversarial sample in a mix with clean data to train the classifier. The model improved the robustness against this single iteration attack. [PERSON] et al. [13] suggested using a multi-iteration method called projected gradient descent (PGD) to train the model. They showed that when using the fast-single iteration method (FGSM), the trained model is still vulnerable against more strong multi-iteration adversarial samples. They suggested that by using PGD adversarial training, the model would gain universal robustness against adversarial samples. The Modified National Institute of Standards and Technology database (MNIST) model trained by this method could maintain over 90% accuracy under PGD and FGSM attacks. This method has become a baseline method of adversarial training [5].  
In recent years, many adversarial training methods have been proposed to improve the performance of the FGSM and PGD adversarial training. The performance improvements have mainly been focused on enhancing robustness, reducing the computation complexity of adversarial training, and reducing the overfitting effect of adversarial training [5]. Details about the advantages and limitations of these methods are discussed in Sections 4 and 5 in this paper.