Adversarial Training with Complementary Labels: On the Beneﬁt of Gradually Informative Attacks
Abstract
Adversarial training (AT) with imperfect supervision is signiﬁcant but receives limited attention.
To push AT towards more practical scenarios, we explore a brand new yet challenging setting, i.e., AT with complementary labels (CLs), which specify a class that a data sample does not belong to.
However, the direct combination of
AT with existing methods for CLs results in consistent failure, but not on a simple baseline of two-stage training.
In this paper, we further explore the phenomenon and identify the underlying challenges of AT with CLs as intractable adversarial optimization and low-quality adversarial examples.
To address the above problems, we propose a new learning strategy using gradually informative attacks, which consists of two critical components: 1) Warm-up Attack (Warm-up) gently raises the adversarial perturbation budgets to ease the adversarial optimization with CLs; 2)
Pseudo-Label Attack (PLA) incorporates the progressively informative model predictions into a corrected complementary loss.
Extensive experiments are conducted to demonstrate the effectiveness of our method on a range of benchmarked datasets.
The code is publicly available at: https://github.com/RoyalSkye/ATCL .
Introduction
Deep neural networks are vulnerable to adversarial examples [15], which motivates the development of various defensive methods [30, 21, 24, 2] to mitigate the arisen security issue.
As one of the most effective and practical defensive methods, adversarial training (AT) [24] has been widely studied [41, 5, 10].
Speciﬁcally, it formulates the problem as min-max optimization, which generates adversarial data during training and minimizes the training loss of the generated adversarial variants.
In this way, the models are equipped with adversarial robustness against human-imperceptible perturbations within the neighborhood of inputs.
Although AT with perfect supervision (e.g., ordinary labels) has been thoroughly studied by previous works [25, 33, 44, 21, 34, 43, 11], the more common learning scenarios with imperfect supervision [45, 42] has only received limited attention.
Complementary labels (CLs) [17], which convey partial label information by identifying a class that a data sample does not belong to, are one of those practical and promising imperfect supervision in weakly supervised learning [3, 27].
Several works [39, 18, 7, 13, 38, 14] recently focused on learning with CLs, where the model trained only with CLs through their designed losses (i.e., complementary loss ¯ ` ) is expected to predict ordinary labels accurately during inference.
Their success illustrates the
[Figure]
possibility of training ordinary classiﬁers even when all the labels given for training are wrong (except that the data and labels are statistically independent).
Due to the low acquisition cost and privacy preservability, it has been applied to online learning [19] and medical image segmentation [31].
To push AT towards more practical scenarios, we explore a brand new yet challenging setting, i.e.,
AT with CLs .
In this paper, our interest is how to equip machine learning models with adversarial robustness when all given labels in a dataset are wrong (i.e., CLs), which is of scientiﬁc interests to both research areas of weakly supervised learning and adversarial learning.
To conduct AT with CLs, a straightforward attempt is to regard ¯ ` as the training objective of the min-max optimization [15, 24].
However, the direct combination of AT with existing methods [39, 18, 7, 13] for learning with
CLs results in consistent failure, but not on a simple baseline of two-stage training (as shown in
Figure 1).
To be speciﬁc, we mainly consider the single complementary label (SCL) with the uniform assumption [17, 18, 7], where labels other than the true label are chosen as a CL with the same probability.
In complementary learning, the complementary losses ¯ ` are obtained by certain correction techniques [17, 39], which guarantee the training with ¯ ` on complementary datasets achieves similar performance to the training with the ordinary loss ` on ordinary datasets.
In contrast, when conducting
AT with CLs, most experiments (as shown in Figure 1 with different ¯ ` and optimizers) consistently show failed training curves except for a simple two-stage baseline, which consists of a natural complementary learning phase and an AT phase using the predicted labels of the ﬁrst-stage model.
The above fact motivated us to further investigate AT with CLs, and we identiﬁed its unique challenges as intractable adversarial optimization and low-quality adversarial examples (as veriﬁed in Figure 2).
Speciﬁcally, we ﬁrst theoretically prove that conducting AT with the complementary risk is statistically consistent to that with the ordinary risk when training with the general backward corrected loss [18].
Although the guarantee holds with sufﬁcient data, it is not preserved any more with a limited number of CLs given in practice [7] (see Eq.
(8) in Section 4.1).
Empirically, we analyze the training dynamics of AT with CLs (e.g., gradient directions and norms), and observe that adversarial optimization with
CLs through ¯ ` suffers from large gradient variance, with the gradient vanishing issue at the early stage of training.
Moreover, we also ﬁnd that the complementary loss as the objective of adversarial optimization fails to generate high-quality adversarial examples due to the less informative nature [17] of CLs and the implicit way of attacking ordinary labels (i.e., attacking
[Equation]
To mitigate the problems, we propose a new learning strategy using gradually informative attacks (in
Algorithm 1) for AT with CLs, which consists of two critical components, i.e., Warm-up Attack (Warmup) and Pseudo-Label Attack (PLA) .
We introduce the Warm-up to ease the intractable optimization with CLs, which is gradually transferred from natural training to AT by controlling the adversarial budget.
We design the PLA to improve the low-quality adversarial generation, which incorporates the informative predictions from the progressively discriminative model itself.
Overall, we propose a uniﬁed framework using a ﬂexible scheduler to adjust two critical components during training.
Our contributions are summarized as follows.
1) Setting level: we study AT with CLs, which is a practical yet thus far unexplored setting.
2) Challenge level: we discover the substantial experimental failures in the direct combination of AT with existing methods for learning with CLs (in Figure 1), and provide the underlying insights of the observed phenomenon from both theoretical and empirical perspectives (in Sections 4.1 and 4.2).
Speciﬁcally, we identify two challenges as intractable adversarial optimization and low-quality adversarial examples.
3) Methodology level: we accordingly propose a uniﬁed framework, using Warm-up and PLA with a controllable scheduler to mitigate the problems (in Sections 4.3).
Experimental level: we conduct extensive experiments to verify the effectiveness of our method, and to understand the beneﬁts of two critical components (in Section 5).
Related Work
Complementary Learning.
Learning with CLs was introduced by [17], where the SCL with the uniform assumption was ﬁrstly considered.
An unbiased risk estimator (URE) was derived by modifying a speciﬁc loss function (e.g., one-versus-all or pairwise comparison) that satisﬁes a symmetric condition.
Continuing with this work, [18] derived a general URE for arbitrary loss functions and models, and further proposed non-negative correction and gradient ascent methods to cope with the overﬁtting issue of URE in practice.
Although URE has good statistical properties, it has inferior empirical performance due to huge gradient variance.
[7] mitigated this problem by proposing a surrogate complementary loss framework, which is a biased risk estimator trading zero bias with reduced variance.
Other than the uniform assumption, [39] considered the biased
CLs, where labels other than the true label are chosen as a CL with different probabilities due to the annotator’s bias.
In addition to the SCL setting, [13] derived an URE of the ordinary risk for multiple complementary labels, and further improved it by minimizing properly chosen upper bounds.
Moreover, there are also several works less related to the loss correction in complementary learning, such as introducing regularization [38] or reweighting [14] during the training process.
Adversarial Training.
As one of the most effective defensive methods, AT has been widely studied to improve the robustness of deep learning models [1, 12, 37, 36, 26, 35, 6].
The standard AT [24] formulated the problem as min-max optimization.
[4] proposed CAT to mitigate the catastrophic forgetting and the generalization issues of AT.
[41] decomposed the prediction error into the natural and boundary errors, and proposed TRADES to balance the classiﬁcation performance between the natural and adversarial examples.
[43] resolved the trade off between robustness and accuracy via reweighting adversarial data by their geometrical information to the decision boundary.
In contrast to previous works, only limited effort has been made to explore AT with imperfect supervision [27, 18].
[45] explored the interaction of AT with noisy labels (NLs), and found that AT itself is NLs correction since the number of PGD steps could be used to improve sample selection quality.
[42] investigated the effects of NLs injection on the adversarial optimization, and proposed NoiLIn to mitigate the robust overﬁtting issue based on the empirical observation that NLs are not always detrimental.
Preliminaries
In this section, we provide preliminaries for ordinary learning, complementary learning and AT.
For complementary learning, we consider the SCL setting with the uniform assumption [17, 18, 7].
For
AT, we focus on the standard method proposed in [24].
3.1 Ordinary Learning
Let X ⇢ R d be the input space, and Y
[ K ] := { 1 , 2 , . . .
, K } ( K > 2) be the label space.
The data { ( x i , y i ) } ni =1 is sampled independently and identically from the joint distribution D with density p ( X, Y ) , which could be further decomposed into p ( X ) p ( Y | X ) .
We deﬁne a class-probability function ⌘ i ( x ) =
p ( Y = i
| X = x ) .
The decision and loss functions are deﬁned as g : X !
R K and ` : Y ⇥ R K !
R + , respectively.
The goal of ordinary learning is to train a classiﬁer f ( x ) :
X !
Y , which is expected to predict the correct label by arg max i g ( x ) i .
The ordinary risk is deﬁned as
[Equation]
3.2 Complementary Learning
In complementary learning, the label space is transformed into ¯ Y , where each ordinary label y is ﬂipped into ¯ y 2 ¯ Y with a class-dependent probability p (¯ y | y ) .
Then, the data is sampled from a different joint distribution ¯ D with density p ( X, ¯ Y ) .
We assume the transition matrix Q 2 R K ⇥ K is invertible, where Q ij = p ( ¯ Y =
j | Y = i ) .
With the uniform assumption, it takes 0 on diagonals and
K  1 on non-diagonals.
The class-probability function is then written as
[Equation]
The complementary risk is deﬁned as ¯ R ( g ; ¯ ` ) =
E ( x, ¯ y )
⇠ ¯ D [¯ ` (¯ y, g ( x ))] , where ¯ ` is a complementary loss function.
Typically, it can be derived by the loss correction, which is a technique that ensures risk or classiﬁer consistency in the weakly supervised setting [27, 17].
The backward correction is a risk consistent algorithm that ensures ¯ R is a statistically consistent risk estimator of the ordinary risk R , while the forward correction is a classiﬁer consistent algorithm that guarantees the classiﬁer learned from ¯ D using ¯ ` converges to the optimal one learned from D using ` .
In complementary learning, [17, 18, 13] focused on the backward correction that multiplies the loss by Q  1 , while [39] proposed a forward correction method via multiplying the model prediction by Q .
Other methods (e.g., a bounded loss) can also be used to derive complementary losses [7, 13].
The detailed complementary loss functions are provided in Table 2 of Appendix B.
General Backward Correction.
Among this line of research, a notable work [18] derived an URE of the ordinary risk, without any restriction on the used loss and model.
Given the notations borrowed from [18, 7]: ` ( g ( x )) = [ ` [Equation]
1 , g [Equation] x )) , ` (2 , g ( x )) , . .
, ` ( K, g ( x ))] and e i is the one-hot column vector with one on the i th entry, the URE is derived as follows:
Proposition 1.
The ordinary risk can be expressed in terms of CLs as follows,
[Equation]
when ¯ ` is rewritten as
[Equation]
With the uniform assumption, ¯ ` can be further rewritten as
[Equation]
With this expression, we can obtain an URE of the ordinary risk only from CLs.
3.3 Adversarial Training
AT has been a commonly used defensive technique that equips deep learning models with adversarial robustness against imperceptible perturbations within a small neighborhood of input.
Here, we consider conducting AT with ordinary labels (e.g., ` is the cross-entropy loss).
Generally, it can be formulated into a min-max optimization problem:
[Equation]
where B ✏ [ x ] = { ˜ x : k x  ˜ x
k p  ✏ } is the closed ball centered at input x with radius ✏ > 0 under l p -norm threat models, and ˜ x is the adversarial data found within B ✏ [ x ] .
Empirically, the solution of inner maximization is approximated by projected gradient descent (PGD) as follows:
[Equation]
where ↵ is the step size, ⇧ is the projection operator that projects the adversarial data back to the epsilon ball, x ( t ) is the adversarial data found at step t , and x (0) is initialized by natural data or natural data with a small Gaussian or uniformly random perturbation.
The adversarial data is updated iteratively in the direction of loss maximization until a stop criterion is satisﬁed.
In this section, we ﬁrst provide some theoretical insights for AT with CLs.
Then, we empirically analyze the experimental failure and identify the critical challenges as intractable adversarial optimization and low-quality adversarial examples when conducting AT with corrected complementary losses.
Accordingly, we propose a new learning strategy with gradually informative attacks.
4.1 Theoretical Analysis
Without loss of generality, below we analyze the general backward correction [18] theoretically, and other popular complementary loss functions on the SCL setting.
Proposition 2.
For the general backward correction, conducting AT on the complementary risk is equivalent to that on the ordinary risk.
However, this is not the case on their empirical risks:
[Equation]
The detailed proof is provided in Appendix A.2.
In brief, when considering the general backward corrected loss, the maximization induced by AT keeps the statistical properties of the complementary risk, and it still yields a consistent risk estimator.
In theory, the adversarial optimization of the complementary risk with the general backward corrected loss is statistically consistent to that of the ordinary risk with the ordinary loss.
But in practice, we can only obtain limited CLs (e.g., the sample size of E ¯ y ⇠ p (¯ Y | X = x ) is one on the SCL setting), which causes the inconsistency between their empirical risks (i.e., the solutions to their inner maximization are different), and hence leads to a difﬁcult adversarial optimization (as veriﬁed in Appendix D.2).
The solution to inner maximization of the complementary risk is equivalent to that of the ordinary risk if and only if maximizing the weighted loss over all candidate CLs, that is E ¯ y ⇠ p (¯ Y | X
= x ) [¯ ` (¯ y, g (˜ x ))] .
From the perspective of AT, we expect to ﬁnd the adversarial examples ˜ x within the neighborhood of input x that make the model predictions on the ordinary label p ✓ ( y | ˜ x ) as low as possible.
When we have ordinary labels, it is quite straightforward to achieve this objective by maximizing the crossentropy ` =  log p ✓ ( y | ˜ x ) .
However, if we further consider recent proposed methods in addition to the general backward correction in complementary learning, most of ¯ ` mathematically try to maximize
[Equation]
or equivalently minimize p
[Equation]
¯ y | ˜ x ) ) as shown in Table 2.
Maximizing ¯ ` leads to the minimization of
[Equation]
, which cannot guarantee the minimization of p ✓ ( y | ˜ x )
[Equation]
In such a case, the inner maximization may serve as a random attacker without prior knowledge.
Hence, corrected complementary losses fail to achieve the objective of AT, and low-quality adversarial examples may be generated, which is detailedly discussed in the following part.
4.2 Empirical Analysis
We conduct the experiment on Kuzushiji to justify the previous theoretical insights.
For the upper panels of Figure 2, we focus on the issue of intractable adversarial optimization by adversarially training the model using several loss functions separately, with three random trials.
For the lower panels of Figure 2, we focus on the issue of low-quality adversarial examples by measuring the different adversarial examples generated by various loss functions, given the same optimization model (i.e., the oracle model, which is trained using AT with ordinary labels).
We show the average results over different seeds and training samples, respectively.
Without loss of generality, here we only show the results of one complementary loss (i.e., LOG [13]), and our proposed method (i.e.,
Warm-up+PLA in Section 4.3).
The detailed experiment settings and more comprehensive empirical results with other complementary losses and datasets are provided in Appendix C.
Intractable Adversarial Optimization.
In the outer minimization of AT, we ﬁrst collect the gradient direction (with respect to the model parameters) of each data in one mini-batch (i.e., 256), and then compute the trace sum of their covariance matrix (the average result for each epoch is shown
[Figure]
in the upper-left panel of Figure 2).
A larger value reﬂects a group of gradient directions with a bigger variance.
Note that the result of LOG nearly reaches the maximum trace sum of covariance matrix of the gradient directions, which results in its consistent failure at the early stage of training.
We also compute the average l 2 -norm of stochastic gradients of the last and ﬁrst layer as shown in the upper-middle and upper-right panels of Figure 2, respectively.
Although some gradient signals exist for LOG in the last layer, the gradients back-propagated to the ﬁrst layer is so small that gradient vanishing problem occurs at the early stage of training.
This phenomenon is similar to that observed in the standard AT, which is conjectured as the prevalence of dead neurons caused by a large radius of epsilon ball [23].
Moreover, considering AT with CLs, it is expected that the gradient norm tends to be small since the observed variance of gradient directions in one mini-batch is extremely large.
The above observations indicate the adversarial optimization with CLs is difﬁcult, and it is rational to use the method (i.e., our Warm-up+PLA) to ease the optimization.
Low-quality Adversarial Examples.
In the inner maximization of AT, given the same optimization model, we measure the quality of generated adversarial examples by computing the cosine similarity of gradient directions (with respect to the same data) and the l 1 -distance of constructed adversarial examples, with the oracle examples generated by ordinary label (in the lower-left and lower-middle panels of Figure 2).
A larger cosine similarity and a lower l 1 -distance indicate a stronger resemblance to the oracle, but not necessarily a stronger attack (or high-quality adversarial examples).
Hence, we further compute the difference of model predictions of natural data and adversarial data on the ordinary label during training (in the lower-right panel of Figure 2).
A bigger difference explicitly demonstrates a stronger attack.
The results show that the complementary loss as the objective of AT with CLs fails to generate high-quality adversarial examples as our analysis in Section 4.1.
4.3 Methodology
To address the previous problems, we accordingly propose a new strategy using gradually informative attacks to ease the intractable adversarial optimization and improve the quality of adversarial examples, respectively.
Our algorithm is concretely presented in Algorithm 1.
Speciﬁcally, it consists of Warm-
with
Using Gradually
Input: number of epochs: E , number of batches: B , number of class: K , radius of epsilon ball: ✏ , number of attack steps: k , step size: ↵ , hyperparameter for exponential moving average of cashed model predictions:  ; hyperparameter for weights:  ;
Output: robust model ✓ R ; 1: p c 1 K  1 ( 1  e ¯ y ) T for all data 2: for e
= 1 , . .
, E do 3:  ,
Update hyperparameters 4: ✏ e , ↵ e , k e
Adversarial budget scheduler .
Warm up Attack 5: for b = 1 , . . .
, B do 6: x, ¯ y
Sample a batch of data 7: p ✓ ( x )
Softmax ( ✓ ( x )) , p c ( x )  p c ( x ) + (1   ) p ✓ ( x ) , p c (¯ y | x ) 8: ˆ y arg max j 6 =
¯
y p c ( j | x ) 9: ˜ x
Approximate the solutions of max ¯ ` ( x, ¯ y ;
10) by PGD( e , ↵ e , k e ) 10:
L =  ( K  1) log(
P j 6 =¯ y p
✓ ( j | ˜ x ) + (1   ) p ✓ (ˆ y | ˜ x )) .
Pseudo-Label Attack 11: ✓
SGD ( ✓ , r ✓ L ) 12: end for 13:
Evaluate( ✏ , ↵ , k ) 14: end for up Attack and Pseudo-Label Attack, whose dynamics are controlled by a ﬂexible scheduler:
[Equation]
where a is the maximum value of the scheduled variable (i.e., ✏ max = ✏ in Warm-up Attack and  max = 1 in Pseudo-Label Attack), e is the epoch index, and E s is the duration of the scheduler.
Both the proposed attacks can be controlled by a ﬂexible scheduler with the increasing and decreasing trends respectively (e.g., see the example in Figure 3).
Below, we describe each component in detail.
Warm-up Attack.
Adversarial optimization is harder compared with ordinary optimization [23], and CLs further strengthen the degree of hardness as observed in our empirical analysis.
The major difference of AT with CLs from the standard AT is the labels used in the adversarial generation.
As shown in Figure 2, training with the adversarial examples generated by different labels results in the different gradient variance.
Since the adversarial generation on CLs induces large gradient variance which causes the difﬁcult adversarial optimization, we can adjust the adversarial generation to control the variance introduced into the optimization.
To be speciﬁc, we adopt a dynamic adversarial budget to gradually enhance the degree of adversarial generation.
Typically, adversarial budgets consist of the radius of epsilon ball ✏ , number of attack steps k , and step size ↵ .
Here, we mainly focus on the dynamics of ✏ in Eq.
The radius of the epsilon ball is increased from 0 to ✏ within E s epochs, and is kept constant until the end of adversarial optimization.
The number of attack steps is constant ( k e = k ), and the step size is increased proportionally to ✏ ( ↵ e = ✏ e ✏ ↵ ).
In this way, the gradually increased adversarial budget can ease the difﬁculty of adversarial optimization.
Pseudo-Label Attack.
Due to the existence of an adversarial budget scheduler, at the early stage of optimization, simple patterns may be prevalent in adversarial data found within an extremely small epsilon ball, which is helpful for the self-evolvement of a discriminative model.
The model tends to assign high conﬁdence to the potential ordinary label, while low conﬁdence to others.
This informative model prediction is a strong supplementary information that is promising for improving the quality of the adversarial generation.
Therefore, we propose to optimize the objective consisting of the convex combination outputs of partial labels (labels other than CLs) and predicted ordinary label.
This transforms the whole process into an optimization that starts with learning with CLs using certain correction techniques, and gradually moves to learning with predicted labels regarding them as ordinary labels.
The loss function can be deﬁned as follows:
[Equation]
where  2 [0 , 1] is a hyperparameter that controls the transition of learning.
Recent studies found that adversarial training can degrade the generalization, and a trade-off between natural accuracy
[Figure]
and adversarial robustness exists [32].
To avoid the effect of such degradation and stabilize the optimization (e.g., a drastic shift of model predictions may occur due to the increasing adversarial budget), we use a simple exponential moving average to collect the dynamics of model predictions, and choose the label with the maximum probability as a predicted ordinary label.
Speciﬁcally, given the model predictions p ✓ ( x ) of the current epoch, the cashed model predictions p c ( x ) is updated as p c ( x ) =
p c ( x ) + (1   ) p ✓ ( x ) , where p c ( x ) is initialized with ( 1  e y ) T K  p c (¯ y | x ) = 0 , and  = 0 .
Experiments
In this section, we empirically verify the effectiveness of our method on MNIST [22], Kuzushiji [8],
CIFAR10 [20] and SVHN [28] datasets, and conduct ablation studies to understand the two attacks.
More detailed information and the conducted experiments are presented in Appendix D.
Setups.
1) General Setups : for MNIST and Kuzushiji, we train a small convolutional neural network, as used in [41], for 100 epochs 3 with batch size of 256.
For CIFAR-10 and SVHN, ResNet18 is trained for 120 epochs with batch size of 128.
The training sets of CIFAR-10 and SVHN are augmented with random cropping and horizontal ﬂipping. 2)
Adversarial Training Setups : we focus on the L 1 threat model.
For MNIST and Kuzushiji, stochastic gradient descent (SGD) is used with learning rate of 0.01 and momentum of 0.9.
PGD is used as the approximation method of solving inner maximization, with ✏ = 0 .
3 , ↵ = 0 .
01 and k = 40 .
For CIFAR10 and SVHN, SGD is used with weight decay of 5e-4 and momentum of 0.9.
The initial learning rate is 0.01, and decayed byat Epoch 30 and 60 of adversarial optimization.
For the L 1 threat model, ✏ = 8 / 255 , ↵ = 2 /and k
= 10 . 3) Complementary Learning Setups : following the settings in [18, 13], for MNIST and Kuzushiji, Adam optimizer is used with learning rate of 1e-3 and weight decay of 1e-4.
For
CIFAR10 and SVHN, SGD is used with weight decay of 5e-4 and momentum of 0.9.
The learning rate is linearly increased to 0.01 within the ﬁrst 5 epochs.
More details are provided in Appendix D.1.
Baseline. 1).
Two-stage method: it ﬁrst trains a model for 50 epochs with the methods of complementary learning (i.e., LOG, which shows better performance and stability compared to others [13]).
Then we re-label the complementary training set using the checkpoint with the best validation performance, and adversarially train another model using the re-labeled training set afterwards.
Conducting adversarial training directly with complementary losses, including FORWARD [39],
FREE, NN [18], SCL_NL, SCL_EXP [7], EXP and LOG [13].
We evaluate the adversarial robustness using PGD20, CW30 and AutoAttack (AA) [9], and report the results of checkpoint with the best
PGD20 test accuracy.
All experiments are conducted with multiple random seeds (i.e., 1-3).
5.1 Performance Evaluation
The detailed results are reported in Table 1, where Oracle refers to the standard AT with ordinary labels, and it is just given for measuring the performance gap between AT with CLs and ordinary labels.
For easy datasets (e.g., MNIST), the complementary losses are possible to obtain satisfying results, while most of them fail on complicated datasets.
We would like to mention that the performance of
[Table]
the two-stage and our methods slightly outperform that of the oracle on SVHN.
We assume it may be attributed to the recent observation that noisy datasets (with a small portion of noisy labels) are not always detrimental to AT, and can even further boost the adversarial robustness [42].
5.2 Ablation Study
In this part
[Table]
we conduct the ablation study to demonstrate the importance of the two components,
i
[Table]
e.,
Warm-up Attack and Pseudo-Label Attack in our method with the critical hyperparameter
[Table]
Two Critical Components.
We investigate the roles of two components in our method by removing them separately.
We report the results within three trials on Kuzushiji and CIFAR10 datasets as shown in the left-middle and right-middle panels of Figure 3.
In summary, warm-up attack could stabilize the optimization especially when the model capacity are not sufﬁcient large, and pseudo-label attack is crucial for the achieving high adversarial robustness.
Speciﬁcally, the warm-up attack achieves quite good performance on Kuzushiji, while limited improvements on CIFAR10.
This is expected due to the difﬁculty of CIFAR10 without further informative attacks.
Pseudo-label attack solves this problem by incorporating the informative model predictions, and hence achieves quite good performance on CIFAR10.
However, it has an unstable result on Kusushiji, which is attributed to the limited model capacity.
It is of great importance to achieve adversarial robustness given limited model capacity.
Therefore, warm-up attack is still a crucial component for stabilizing the optimization.
Hyperparameter.
We investigate the performance sensitivity to the key hyperparameter E s , which controls the growing speed of informative attacks.
We report the results within three trials on Kuzushiji as shown in the right panels of Figure 3.
The result shows a similar performance across a wide range of E s , which demonstrates that our method is not sensitive to the tuning of key hyperparameter.
Conclusion
To the best of our knowledge, this is the ﬁrst work to study adversarial training (AT) with complementary labels (CLs), and to analyze its challenges from both theoretical and empirical perspectives.
To solve them, we proposed a new learning strategy using gradually informative attacks, narrowing the performance gap between AT with CLs and ordinary labels.
Our work shed light on the applications of AT to a more practical scenario (e.g., with imperfect supervision).
In this paper, we focused on the standard AT algorithm, which formulates the problem as min-max optimization.
We leave more advanced algorithms (e.g., TRADES) and other complementary settings (e.g., multiple CLs) to the future work.
Moreover, CLs can be viewed as an extreme case of noisy labels with 100% noise rate, or partial labels where the labels other than the CL are the candidate set of labels.
Hence, we hope our work could provide new insights for AT with various imperfect supervision in the ML community.
Acknowledgments and Disclosure of Funding
JNZ and BH were supported by NSFC Young Scientists Fund No. 62006202, Guangdong Basic and
Applied Basic Research Foundation No. 2022A1515011652, and RIKEN Collaborative Research
Fund.
BH was also supported by RGC Early Career Scheme No. 22200720, RGC Research Matching
Grant Scheme No. RMGS2022_11_02 and No. RMGS2022_13_06, and HKBU CSD Departmental
Incentive Grant.
JFZ was supported by JSPS KAKENHI Grant Number 22K17955 and JST ACT-X
Grant Number JPMJAX21AF, Japan.
TLL was partially supported by Australian Research Council
Projects DP180103424, DE-190101473, IC-190100031, DP- and FT-220100318.
GN and MS were supported by JST AIP Acceleration Research Grant Number JPMJCR20U3, Japan.
MS was also supported by the Institute for AI and Beyond, UTokyo.
We would also like to thank the anonymous reviewers of NeurIPS 2022 for their constructive comments and recommendations
[-the initial period E i = 10 , we optimize the model using the original TRADES loss with 1 /  = 1 , and regard predicted labels (i.e., arg max j 
-]
[-We summarize the comprehensive ablation study results in Table 
-]