Efficient and Effective Augmentation Strategy for Adversarial Training
Anonymous Author(s)
Abstract
The sample complexity of Adversarial training is known to be significantly higherthan standard ERM based training.
Although complex augmentation techniqueshave led to large gains in standard training, they have not been successful with
Adversarial Training.
In this work, we propose Diverse Augmentation based Joint
Adversarial Training (DAJAT) that uses a combination of simple and complexaugmentations with separate batch normalization layers to handle the conflictinggoals of enhancing the diversity of the training dataset, while being close tothe test distribution.
We further introduce a Jensen-Shannon divergence lossto encourage the joint learning of the diverse augmentations, thereby allowingsimple augmentations to guide the learning of complex ones.
Lastly, to improvethe computational efficiency of the proposed method, we propose and utilize atwo-step defense, Ascending Constraint Adversarial Training (ACAT) that usesan increasing epsilon schedule and weight-space smoothing to prevent gradientmasking.
The proposed method achieves a better robustness-accuracy trade-offcompared to existing methods on the RobustBench Leaderboard for CIFAR-10 and
CIFAR-100 on ResNet-18 and WideResNet-34-10 architectures.
Introduction
Deep Neural Network based classifiers are vulnerable to crafted imperceptible perturbations knownas Adversarial Attacks [46] that can flip the predictions of the model to unrelated classes leading to disastrous implications.
Adversarial Training [17, 32, 58] has been the most successful defensestrategy where a model is explicitly trained to be robust in the presence of such attacks.
While earlydefenses focused on designing suitable loss functions for training, subsequent works [34, 39] showedthat with careful hyperparameter tuning, even the two most popular methods PGD-AT [32] and
TRADES [58] yield comparable performance, highlighting the saturation in performance with respectto changes in the training loss.
Schmidt et al.
[40] observed that adversarial training has a largesample complexity and further gains require the use of additional training data.
Subsequent works[7, 19] indeed used additional data whose distribution is close to that of the original dataset, in orderto obtain performance gains.
This large data requirement, which is impractical to assume, has led toan exploration towards augmentations based on Generative Adversarial Networks [16] and Diffusionbased models [23, 19].
However, the use of such generative models incurs an additional training cost,and suffers from limited diversity in low-data regimes, and in datasets with high resolution images.
While standard Empirical Risk Minimization (ERM) based training also benefits from the use ofadditional data, the most practical and efficient augmentation method has been the use random transformations such as Crop, Rotation, Color Jitter, and contrast, sharpness and brightness adjustments[29, 10, 11].
Some of these augmentations change the images significantly in input space whilebelonging to the same class as the original image.
However, prior works [39, 18, 45] have surprisinglyfound that augmentations which cause large changes in the input distribution do not help adversarial training significantly.
Thus, the commonly used augmentations in adversarial training are the simpletransformations, zero padding followed by random crop, and horizontal flip [39, 34, 18].
In this work, we show that it is indeed possible to utilize complex augmentations effectively in
Adversarial training as well , by jointly training on simple and complex data augmentations usingseparate batch-normalization layers for each kind of augmentation.
While complex augmentationsincrease the data diversity resulting in better generalization, simple augmentations ensure that themodel specializes on the training data distribution as well.
We further minimize the Jenson-Shannondivergence between the softmax outputs of various augmentations to enable the simple augmentationsto guide the learning of complex ones.
In order to improve the computational efficiency of theproposed method, we use two attack steps (instead of 10) during training.
We further show that byprogressively increasing the magnitude of perturbations and performing smoothing in weight space,it is indeed possible to improve the stability of training.
Our contributions are listed below:
• We propose Diverse Augmentation based Joint Adversarial Training (DAJAT) to utilize dataaugmentations effectively in Adversarial training.
The proposed approach can be integratedwith many augmentations and adversarial training methods to obtain performance gains.•
We propose and integrate DAJAT with an efficient 2-step defense strategy, Ascending Con-
straint Adversarial Training (ACAT) that uses linearly increasing ε schedule, cosine learningrate and weight-space smoothing to prevent gradient masking and improve convergence.
• We obtain improved robustness and large gains in standard accuracy on multiple datasets
(CIFAR-10, CIFAR-100, ImageNette) and model architectures (RN-18, WRN-34-10).• We obtain remarkable gains in a low data scenario (CIFAR-100, Imagenette) where data
augmentations are most effective.
On CIFAR-100, we outperform all existing methods on
the RobustBench leaderboard [9], including the ones that utilize additional training data
Related Works
We discuss various existing strategies for improving the Adversarial robustness of Deep Networks.
Adversarial Training: Goodfellow et al.
[17] proposed FGSM adversarial training where single-stepadversarial samples were used for training.
However, these models were susceptible to gradientmasking [35], where the local loss landscape becomes convoluted leading to the generation of weakersingle-step attacks during training.
This leads to a false sense of security against single-step attacks,while the models are still susceptible to stronger multi-step attacks such as PGD [32].
PGD-AT[32, 39] used multi-step attacks in a similar adversarial training formulation to obtain robust modelsthat stood the test of time against several attacks [3, 8, 43].
TRADES [58] explicitly optimizesthe trade-off between the accuracy on natural and adversarial examples by minimizing the crossentropy loss on natural images along with the Kullback-Leibler divergence between the predictions ofadversarial and clean images.
In the proposed defense, we use the base loss from TRADES-AT [58].
Several works have explored auxiliary techniques such as weight-space smoothing [26, 51], architectural changes [18, 54] and increasing the diversity of training data by using additional naturaland synthetic data [40, 7, 18, 38].
Increasing the diversity of training data achieves significantperformance gains since the sample complexity of adversarial training is known to be high.
Augmentations in Adversarial Training: While data augmentations such as contrast, sharpnessand brightness adjustments are known to improve performance in the standard training regime, theyhave not led to substantial gains in adversarial training.
AutoAugment [10] uses Proximal Policy
Optimization to find the set of policies that can yield optimal performance on a given dataset.
Contraryto prior works [39, 18], we show that the policies that are optimized for standard training indeed yielda boost in performance of adversarial training as well, when used in the proposed training framework.
In a recent work, Rebuffi et al.
[38] show that it is possible to obtain substantial gains in robustaccuracy by using spatial composition based augmentations such as CutMix [55] and CutOut [13]that preserve low-level features of the image.
Cutmix replaces part of an image with another and alsocombines the output softmax vectors in the same ratio while CutOut blanks out a random area of animage.
The authors hypothesize that the augmentations used in Adversarial training need to preservelow-level features, which severely limits the possibilities for mitigating the large sample complexityin adversarial training.
We show that by using the proposed approach, it is indeed possible to useaugmentations such as Color Jitter, contrast, sharpness and brightness adjustments that significantlychange the low level statistics of images.
Preliminaries: Notation and Threat Model
We consider the Adversarial Robustness of Deep Neural Network based classifiers.
We denote aninput image as x ∈ X and the corresponding ground truth label as y ∈ [0 , 1] .
We denote a simpletransformation of x obtained using Pad, Crop and Horizontal flip (referred to as Base augmentations)by x base and other transformations of x by the respective subscript.
For example, x auto refers tothe image x being transformed by AutoAugment (AA) [10] followed by the base augmentations.
We denote function mapping of the classifier C from input space X to the softmax vectors usingf
θ ( . ) , where θ denotes the network parameters.
Adversarial examples corresponding to the imagesx , x base and x auto are denoted using ˜ x , ˜ x base and ˜ x auto respectively.
We consider the ℓ ∞ normbased threat model, where ˜ x is a valid perturbation within ε if it belongs to the set
A ε ( x ) such that
A ε ( x ) = { ˜ x : || ˜ x − x || ∞ ≤ ε } .
We consider adversarial robustness within ε = 8 / 255 [32, 58].
Motivation: Role of Augmentations in Neural Network Training
In this section, we first explore the contrasting factors that influence the training of neural networkswhen the data is augmented (Sec.4.1), and further delve into the specifics of adversarial trainingwhich make it challenging to obtain gains from complex data augmentations (Sec.4.2).
4.1 Impact of Augmentations in Neural Network Training
Conjecture-1:
We hypothesize that the role of data augmentations in the training of Neural Networksis influenced by the following contrasting factors:
(i)
Reduced overfitting due to an increase in diversity of the augmented dataset, leading to better
generalization of the network to the test set.
(ii) Larger domain shift between the augmented data distribution and the test data distribution,
leading to a drop in performance on the test set.
(iii) Capacity of the Neural Network in being able to generalize well to the augmented dataset and
the test set for the given task.
Justification: The training of Neural Networks using augmented data can be considered as a problemof domain generalization, where the network is trained on a source domain (augmented data) and isexpected to generalize to a target domain (test data).
We use the theoretical formulation by Ben-Davidet al.
[4] shown below to justify the respective claims in Conjecture-1:
[Equation]
(i)
The use of a more diverse or larger source dataset reduces overfitting, improving the performanceof the network on the source distribution.
From Eq.1, expected error on the target distribution
ϵ t (test set in this case) is upper bounded by the expected error on the source distribution
ϵ s (augmented dataset) along with other terms.
Therefore, improved performance on the
augmented distribution can improve the performance on the test set as well.
(ii)
The expected error on the target distribution ϵ t is upper bounded by the distribution shift
between the source and target distributions 12 d F ∆ F ( s, t ) along with other terms.
Therefore,
a larger domain shift between the augmented and test data distributions can indeed limit the
performance gains on the test set.
(iii)
The constant λ in Eq.1 measures the risk of the optimal joint classifier: λ = min f ∈F ϵ s ( f ) + ϵ t ( f ) .
Neural Networks with
a higher capacity
can
minimize the expected risk on the source set ϵ s and
the risk of the optimal joint classifier effectively.
Therefore, capacity of the Neural Network
and complexity of the task influence the gains that can be obtained using augmentations
4.2 Analysing the role of Augmentations in Adversarial Training
We analyse the trade-off between the factors described in Conjecture-1 for adversarial training whencompared to standard ERM training.
In addition to the goal of improving accuracy on clean samples,adversarial training aims to achieve local smoothness of the loss landscape.
Hence, the complexity of
Adversarial Training is higher than that of standard ERM training, making it important to use largermodel capacities to obtain gains using data augmentations (based on Conjecture-1 (iii)).
This justifiesthe gains obtained by Rebuffi et al.
[38] on the WRN-70-16 architecture by using CutMix based
[Table]
augmentations (2.9% higher robust accuracy and 1.23% higher clean accuracy).
The same methoddoes not obtain significant gains on smaller architectures such as ResNet-18 where a 1.76% boost inrobust accuracy is accompanied by a 2.55% drop in clean accuracy.
Secondly, while the distribution shift between augmented data and test data ( 12 d F ∆ F ( s, t ) ) may besufficiently low for natural images leading to improved generalization to test set (Conjecture-1(i,ii))
the same may not be true for adversarial images.
There is a large difference between the augmenteddata and test data in pixel space, although they may be similar in feature space.
Since adversarialattacks perturb images in pixel space, it is likely that the distribution shift between the correspondingperturbations widens further.
Based on Conjecture-1(ii), unless this difference is accounted for,complex augmentations cannot improve the performance of adversarial training.
This trend has alsobeen observed empirically by Rebuffi et al.
[38], based on which they conclude that the augmentationsdesigned for robustness need to preserve low-level features.
We present the performance of Adversarial Training by using either Base augmentations (Pad+Crop,
Flip) or AutoAugment [10] during training and inference on the CIFAR-10 dataset using ResNet-18and WideResNet-34-10 architectures in Table-1.
Firstly, we note that by using AutoAugment duringtraining alone, robust accuracy on the test set drops by ∼ 1 .
5 − 2% which is as observed in priorwork [18].
Secondly, the clean and robust accuracy drop by ∼ 6 .
5% when augmented images areused for both training and testing, highlighting the complexity of the learning task.
Proposed Method
5.1 Background: TRADES-AWP Adversarial Defense
We briefly discuss the TRADES-AWP [58, 51] defense, which is the base algorithm used in DAJAT.
[Equation]
Firstly, an adversarial attack is generated by maximizing the KL divergence between the softmaxpredictions of the clean and adversarial examples iteratively for 10 attack steps.
An Adversarial
Weight Perturbation step additionally perturbs the weights of the model in order to maximize theoverall loss in weight-space (Eq.2).
The perturbed weights are constrained relative to the weights ofthe given layer l as, ||
ˆ θ l || ≤ γ · ||
θ l || .
The overall training loss is a combination of Cross-entropy losson clean samples and the KL divergence term.
The latter is weighted by a factor β that controls therobustness-accuracy trade-off.
Training the model using Adversarial Weight Perturbations leads tosmoothing of loss surface in the weight space, resulting in better generalization to the test set [51, 45].
5.2 Diverse Augmentation based Joint Adversarial Training (DAJAT)
As discussed in Section-4, the use of augmentations in training can be viewed as a problem ofdomain generalization, where performance on the source distribution or augmented dataset is crucialtowards improving the performance on the target distribution or test set.
Since adversarial training isinherently challenging, for limited model capacity it is difficult to obtain good performance on thetraining data that is transformed using complex augmentations.
Moreover, the large distribution shiftbetween augmented data and test data, specifically with respect to low-level statistics, results in poorgeneralization of robust accuracy to the test set.
To mitigate these challenges, we propose the combined use of simple and complex augmentationsduring training so that the model can benefit from the diversity introduced by complex augmentations,while also specializing on the original data distribution that is similar to the simple augmentations.
We propose to use separate batch normalization layers for simple and complex augmentations, soas to offset the shift in distribution between the two kinds of augmentations.
Motivated by AugMix[22], we additionally minimize the Jenson-Shannon (JS) divergence between the softmax outputs ofdifferent augmentations, so as to allow the simple augmentations to guide the learning of complexones.
We present the training loss of the proposed Diverse Augmentation based Joint Adversarial
Training (DAJAT) below:
[Equation]
Adversarial attacks are generated individually for each augmentation by maximizing the respective
KL divergence term of the TRADES loss shown in Eq.3.
To improve training efficiency, we compute˜ x using two attack steps with a step-size of ε .
We use a combination of a linearly increasing scheduleof ε , cosine learning rate schedule and model weight-averaging [27] to improve the stability andperformance of adversarial training (Details in Sec.5.4).
The DAJAT loss (Eq.5) is a combination ofthe TRADES 2-step loss on each of the augmentations x base and x auto(t) , along with an adversarialweight perturbation step on the loss corresponding to the base augmentations alone to reduce computational cost.
For every batch normalization layer, two sets of running statistics and affine parametersare maintained and used for simple and complex augmentations respectively (Ref: Algorithm-2).
While we use AutoAugment in our main approach, we show in Table- 6 that the proposed approachworks well with other augmentations as well.
The role of the base (primary) augmentations isprimarily to learn the batch normalization layers that would be used during inference time, andto provide better supervision for the training of complex augmentations using the JS divergenceterm.
The role of the complex (secondary) augmentations is to enhance the diversity of the trainingdataset.
Therefore we use a single primary augmentation and multiple instances of the secondaryaugmentation.
We find that the gains in performance saturate with the addition of more instancesof secondary augmentation, and therefore recommend the use of a single base augmentation andtwo instances of secondary augmentation for the best performance-accuracy trade-off.
We note from
Table-2 that in this setting, the computational complexity of the proposed method is on par with the
TRADES-AWP [58, 51] defense, while achieving considerable performance gains.
5.3 Split Batch Normalization Layers for Different Augmentations
A Batch Normalization (BN) layer [25] is implemented as follows on a given feature map g ( x i ) ofthe input image x
i : ˆ g ( x i ) =
g ( x i ) − µ σ · γ + β .
Here, µ and σ denote the mean and standard deviationof the current mini-batch during training.
During inference, these are set to the running mean andvariance computed during training.
γ and β constitute parameters of the network that are trained.
Prior works use separate batch normalization layers to improve the performance of standard [53,50, 33] or adversarial training [52, 49], in both supervised [53, 50, 33, 52, 49] and self-supervisedsettings [28, 15].
The proposed defense DAJAT uses separate batch normalization layers for simpleand complex augmentations as discussed in the previous section.
We do not use separate batchnormalization for clean and adversarial images here.
In DAJAT, we maintain two sets of BN statistics µ and σ , and two sets of affine parameters, β andγ for every BN layer.
We plot the cosine similarity between the BN layers corresponding to Baseaugmentations and AutoAugment across different layers on a WideResNet-34-10 model trained using
DAJAT on CIFAR-10 in Fig.1.
While the mean and variance are similar across most of the layers(0-30 in x-axis), we note significant differences in the γ and β values, specifically in the initial layers.
[Figure]
a
[Figure]
The use of different parameters for each augmentation type ensures that the function mapping differsfor each augmentation, thereby effectively offsetting the large differences in low level statistics.
5.4 Ascending Constraint Adversarial Training (ACAT)
In this section, we discuss the methods incorporated to improve the training efficiency of DAJAT ingreater detail.
We apply these methods to the TRADES-AWP defense to independently analyse theirimpact, and term the proposed defense as Ascending Constraint Adversarial Training (ACAT).
Weaim to improve the training efficiency by reducing the number of attack steps of the base defensefrom 10 to 2.
We use two attack steps for training since it is known to be more stable when comparedto single-step adversarial training, while still being computationally efficient [44].
As shown in Fig.2, naively reducing the number of attack steps to 2 in TRADES-AWP AT (Fixedconstraint AT) causes a drop in clean and robust accuracy.
While the drop is larger at higher trainingε , a drop in clean accuracy is seen at ε = 8 / 255 as well.
Further, the large robustness gap betweenlast and best epochs indicates that the training stability deteriorates towards the end of training.
Curriculum learning approaches [42, 6] have been used to improve robustness-accuracy trade-off inadversarial training.
Prior works [41, 1] also show that training convergence at large ε bounds canbe improved by linearly increasing ε as training progresses.
Inspired by this, we propose to linearlyincrease ε alongside a cosine learning rate schedule and weight-space smoothing for improvingthe stability and convergence of training (Ref: Algorithm-1).
The use of a lower learning rate atlarger ε improves training stability.
As shown in Fig.2, the performance and stability of the ACATare significantly better when compared to the TRADES-AWP 2-step baseline, specifically at largerperturbation bounds, at the same computational cost.
The proposed defense maintains a good cleanaccuracy at all the training ε values considered, and has < 0 .
1% robustness difference between lastand best epochs.
We thus show that even without modifying the training loss function it is possible to obtain significantgains in the stability and performance of 2-step adversarial training by using the proposed Ascending
Constraint Adversarial Training.
The proposed method can indeed improve the performance of otherdefenses such as GAT [43] and NuAT [44] as well, as shown in Table-7.
Analysis of the proposed ACAT defense:
Conjecture-2: We hypothesize that given a Neural Network f θ ε that minimizes the TRADES loss[58] within a maximum perturbation radius of ε , and has sufficient smoothness in weight space withinan ℓ 2 radius ψ around θ ε , there exist ε ′ >
ε and a model f θ ε ′
where || θ ε ′ − θ ε || ≤ ψ , such that f θ ε ′has a lower TRADES loss within ε ′ when compared to f θ ε .
Justification presented in Section-A.2.
Based on Conjecture-2, by selecting a small enough learningrate η and large enough ψ , it is possible to move towards a better solution w.r.t.
the TRADES lossat ε ′ .
The smoothness of loss surface further ensures that the gradients at ε ′ are bounded with alow magnitude, preventing the onset of catastrophic overfitting, which is known to be associatedwith large magnitude gradients [31].
This motivates the proposed approach ACAT that effectivelycombines an increasing ε schedule, cosine learning rate schedule that allows low learning rates atlarger ε values, and adversarial weight perturbation to ensure smoothness in the loss surface.
Stability improvements obtained using ACAT:
We consider an extreme case of using single-stepattacks for training, to demonstrate the stability improvements obtained using ACAT.
We consider acheckpoint obtained at ε = 7 .
25 / 255 while training using the proposed ACAT defense on CIFAR-
[Table] [Table]
dataset for a WideResNet-34-10 architecture.
We use this model as an initialization and performsingle-step adversarial training using the TRADES-AWP training objective at ε = 7 . 5 / 255 .
Our goalhere is to merely verify the stability of single-step training, although the use of single-step attackmakes the robustness gains marginal.
We present the clean accuracy and robust accuracy against
PGD-20 attack using different values of Adversarial Weight Perturbation step size γ in Fig.3(a).
Itis evident from the plots that for a fixed value of learning rate, increasing γ can delay the onset ofgradient masking, thereby improving the training stability.
We also note marginal improvements inperformance at higher γ , due to the enhanced generalization.
Therefore, weight-space smoothingindeed helps in improving the performance and stability of the proposed defense.
We also note from
Fig.3(b)
that for a fixed value of γ = 0 .
01 , lower learning rate leads to better stability, thereforecosine schedule also helps in improving stability.
We note that the value of gamma in relation to thelearning rate is crucial.
Therefore, in the proposed approach, we use a fixed value of γ and reduce thelearning rate using a cosine learning rate schedule to improve training stability as ε increases.
Experiments and Results
6.1 State-of-the-art comparison
We compare the performance of the proposed defenses ACAT and DAJAT against the 2-step and10-step state-of-the-art defenses NuAT2-WA [43], TRADES-AWP [58, 51] and PGD-AT [32, 39] in
Tables- 2, 3 and 4 on the CIFAR-10, CIFAR-100 [30] and ImageNette [24, 12] datasets.
Althoughthere have been several defenses after this, we show in Table-12 that TRADES-AWP outperformsthem in most settings, and the proposed defense DAJAT consistently outperforms all methods,showing substantial gains in performance.
Further, since we integrate the proposed approach with
TRADES-AWP, we primarily compare our approach with this across all datasets.
We show in Table13 that DAJAT can be integrated with other base defenses [1, 37] as well to obtain performance gains.
We integrate model weight averaging with the TRADES-AWP defense (termed as TRADES-AWPWA) as well for a fair comparison.
We train all models for 110 epochs unless specified otherwise.
ACAT:
We compare the performance of the proposed 2-step defense ACAT with the existingstate-of-the-art 2-step defense NuAT2-WA [44] in the first partition of Table-2.
While we achievesimilar performance on ResNet-18, we obtain improvements in both clean and robust accuracy on
WideResNet-34-10.
We show in Section-A.3 that our proposed defense ACAT can be integratedwith the Nuclear Norm training objective as well to obtain improved results.
The performance ofthe proposed ACAT defense is superior to PGD-AT (10-step) defense [39] as well.
When comparedto the TRADES-AWP (10-step) defense, ACAT achieves substantial gains in clean accuracy andimproved robust accuracy on CIFAR-100 (Table-3), and improved clean accuracy at a slight drop inrobust accuracy on CIFAR-10 (Table-2), at half the computational cost.
[Table]
DAJAT:
We present three variants of the proposed defense DAJAT, by using one, two and three
AutoAugment based augmentations for every image, denoted as (Base, AA), (Base, 2*AA) and (Base,3*AA) respectively.
Even by using only a single augmentation (Base, AA), we obtain improvedclean and robust accuracy when compared to most of the baselines considered across all datasetsand models.
By increasing the number of augmentations to 2 (Base, 2*AA), we observe consistentgains in robust and clean accuracy in all cases.
In this setting, the computational complexity of theproposed approach matches with that of TRADES-AWP [51] as shown in Table-2.
With the setting(Base, 3*AA), we further obtain marginal improvements in performance over (Base, 2*AA).
Overall, using the (Base, 2*AA) approach, which has comparable time complexity as the TRADESAWP 10-step defense, we obtain large gains ranging from 3.8% to 7% on clean accuracy and ∼ 1 .
8%in robust accuracy against AutoAttack [8] across most settings.
On the Imagenette dataset we obtain4.2% higher clean accuracy and 4.49% higher robust accuracy, showing that augmentation strategieswork best when the amount of training data is less when compared to the complexity of the task.
Weobserve a similar trend using smaller subsets of training data on CIFAR-10 in Fig.
Scaling to higher attack steps: While the use of 2 attack steps helps in improving the trainingefficiency of DAJAT, we show that by using more attack steps and longer training epochs, we canindeed obtain further gains in performance.
The varying ε schedule in DAJAT allows the use of anincreasing schedule in the number of steps as well, thereby limiting the overall cost associated withhigher attack steps.
We present results by increasing the number of attack steps from 2 to 5 uniformlyevery 50 epochs in Table-4.
We obtain ∼ 3 .
5% and 6 − 9% higher clean accuracy, along with1 − 1 .
6% and 1 .
7 − 3 .
2% gains in robust accuracy against AutoAttack on CIFAR-10 and CIFAR-100respectively when compared to the TRADES-AWP-WA 200 epoch baseline.
This outperforms allthe defenses on the RobustBench leaderboard [9] with respect to the robustness-accuracy trade-off.
On CIFAR-100 RobustBench leaderboard, we outperform all existing methods w.r.t.
both clean androbust accuracy, including the ones that use additional data, showing that data augmentations can beeffectively used to overcome the large sample complexity of adversarial training.
The use of diverseaugmentations in DAJAT also improves the generalization of the model to Common Corruptions by4% and 8% on CIFAR-10-C and CIFAR-100-C datasets [21] respectively.
6.2 Ablation experiments
We present ablation experiments to highlight the significance of different components of the proposedapproach in Table-5 on the CIFAR-10 dataset using ResNet-18 architecture.
All experiments are runfor 110 training epochs, except A7 which is run for 220 epochs.
We show the importance of the JSdivergence term in the proposed loss in the ablations A1-A6 of Table-5.
Using the JS divergence termwe obtain ∼ 1% higher clean accuracy across (Base, AA), (Base, 2*AA) and (Base, 3*AA) settingsof the proposed defense.
For (Base, 2*AA) and (Base, 3*AA) we obtain marginal improvements inrobust accuracy as well.
From A7, A9 and A10, we find that the proposed JS divergence term helpseven in the case where both augmentations of an image are generated using the same pipeline.
Usingtwo AutoAugment based transformations, we obtain 1.6% higher clean accuracy when compared tothe 220 epoch 2-step defense at a comparable computational cost.
Comparing A9, A10 and A11, wenote that the use of simple and complex augmentations indeed shows improvements over the case ofusing 2 complex or simple augmentations alone.
The importance of split-batch norm in the proposedapproach can be evidently seen by comparing A12 and A14.
By using single batch norm (A12),robust accuracy drops by 8.24%.
Further, in this case if the JS term is also dropped, the robustness of
[Table] [Table]
the network is almost completely lost.
This shows that using a single batch norm layer for diverseaugmentations makes it harder for the network to converge.
We also note that the JS divergence termindeed helps in improving the convergence of training in addition to improving performance.
6.3 Combining the proposed defense with other augmentations
We explore combining the proposed defense DAJAT with other augmentations in Table-6, and alsoexplore the impact of individual augmentations in AutoAugment in Table-8.
We do not use the JSdivergence term for Cutmix and Mixup since they involve changes in the label space.
We note thatwithout using any augmentation in the training dataset, we obtain poor clean and robust accuracy,highlighting the importance of the simple augmentations, Pad and Crop followed by horizontal flip.
The proposed approach is able to obtain good performance gains using AutoAugment [10], Color
Jitter and CutOut [13] augmentations, highlighting that it can work well with pixel-level and spatialaugmentations.
In case of CutMix [55] and Mixup [57], since the base accuracy obtained by usingthe augmentation alone is itself very poor, combining them with the proposed approach does notyield competent results.
However they are considerably better than naively using the augmentation.
This shows that the proposed approach enables the use of a variety of augmentations without theneed for careful selection.
The use of Cutmix and Mixup in adversarial training are challenging sincethey involve changes in label space.
We note that Rebuffi et al.
[38] obtain considerable gains using
Cutmix along with many other improvements.
However, naively augmenting using CutMix leads toa considerably degraded performance.
By incorporating some of the tricks reproduced by Rade etal.
[36] we obtain improvements in the CutMix baseline and further gains in the proposed method(Ref:
Sec.
C.4, Table-11).
For a similar computational budget, we compare with Rebuffi et al.
[38] in
Table-10, where we obtain gains of 1.7% clean and 3.3% robust accuracy (Details in Sec.C.4)
Conclusions
Contrary to prior knowledge, we show that it is indeed possible to use common augmentation strategiesthat modify the low-level statistics of images to improve the performance of adversarial training.
We propose a novel defense Diverse Augmentation based Joint Adversarial Training (DAJAT) thatuses a combination of simple and complex augmentations with separate batch normalization layersto allow the network training to benefit from the diverse training data distribution obtained usingcomplex augmentations, while also being trained on a distribution that is close to the test set.
Theuse of JS divergence term between network predictions of different augmentations enables the jointlearning across various augmentations.
We improve the efficiency of the proposed defense by utilizingthe proposed Ascending Constraint Adversarial Training (ACAT) that improves the stability andperformance of TRADES 2-step adversarial training significantly by using a linearly increasing εschedule along with a cosine learning rate schedule and weight-space smoothing.
Limitations: While we focus our work on how to use augmentations effectively in adversarialtraining, we do not focus on which augmentations are best suited for the same.
We believe this workcan open up further possibilities towards finding better data augmentations for adversarial training.
Checklist
For all authors...
(a) Do the main claims made in the abstract and introduction accurately reflect the paper’s contributions and scope?
[Yes] (b) Did you describe the limitations of your work?
[Yes] See Section-
(c) Did you discuss any potential negative societal impacts of your work?
[N/A]
There are no knownnegative societal impacts of our work.
(d) Have you read the ethics review guidelines and ensured that your paper conforms to them?
[Yes]
If you are including theoretical results...
(a) Did you state the full set of assumptions of all theoretical results?
[N/A] [Table]
(b) Did you include complete proofs of all theoretical results?
[N/A] [Table]
If you ran experiments...
[Table]
(a) Did you include the code, data, and instructions needed to reproduce the main experimental
[Table]
results (either in the supplemental material or as a URL)?
[Yes] Code and ReadMe.md submitted
[Table]
as Supplementary material
[Table]
(b) Did you specify all the training details (e.g., data splits, hyperparameters, how they were chosen)?
[Table]
[Yes] Section-C.2 and ReadMe.md in the Supplementary material
[Table]
(c) Did you report error bars (e.g., with respect to the random seed after running experiments
[Table]
multiple times)?
[Yes] [Table]
[Table]
(d) Did you include the total amount of compute and the type of resources used (e
[Table]
g., type of GPUs,
[Table]
internal cluster, or cloud provider)? [Yes] Details on compute: Table-2, Details on resources:
[Table]
Section- C.
[Table]
If you are using existing assets (e
[Table]
g., code, data, models) or curating/releasing new assets...
[Table]
(a) If your work uses existing assets, did you cite the creators?
[Yes] See Section- C.
[Table]
(b) Did you mention the license of the assets?
[Yes] See Section- C.
[Table]
(c) Did you include any new assets either in the supplemental material or as a URL?
[Yes] We share
[Table]
the code for the proposed approach
[Table]
(d) Did you discuss whether and how consent was obtained from people whose data you’re us-
[Table]
ing/curating?
[N/A] We use only publicly released and open-sourced datasets and codes
[Table]
(e) Did you discuss whether the data you are using/curating contains personally identifiable
informa-
[Table]
tion or offensive content?
[Yes] See Section-C.
[Table]
If you used crowdsourcing or conducted research with human subjects...
[Table]
(a) Did you include the full text of instructions given to participants and screenshots, if applicable?[N/A](b) Did you describe any potential participant risks, with links to Institutional Review Board (IRB)approvals, if applicable?
[N/A](c
Did you include the estimated
hourly wage paid
to
participants and the total amount spent onparticipant compensation
[N/A
A Details on ACATA.1 ACAT training algorithm
The algorithm for the proposed ACAT defense is presented in Algorithm-1.
We consider an ℓ ∞ threat model of 554 perturbation radius ε .
The perturbation bound for attack generation ε asc is linearly increased from 0 to ε duringtraining (L3).
The learning rate follows a cosine schedule across the training epochs as shown in L4.
The attack 556 generation (L7-L12) is done for 2 iterations and follows the TRADES [58] settings.
Initially Gaussian noise ofmagnitude 0 .
001 is added to every pixel.
The KL divergence loss between the clean and perturbed images is 558 maximized using the perturbation step size ε asc .
Further, the perturbation is clipped to remain within the threatmodel in every iteration.
As shown in L14, the TRADES-AWP [51] loss is used for adversarial training.
The loss L AWP ( θ ) is maximizedwith respect to θ to find the perturbed model weights ˜ θ within the constraint set M ( θ ) (L15).
Further, the modeltraining is done at ˜ θ , after which the adversarial weight pertubation δ AWP is subtracted to offset the perturbation 563 in weights (L17).
The defense ACAT does not use any additional training hyperparameters when compared tothe TRADES-AWP defense.
We vary the hyperparameter β to obtain optimal results.
We show the trend of 565 model performance across variation in β in Section-C.2.
A.2 Analysis of the proposed ACAT defense
Conjecture-2: We hypothesize that given a Neural Network f θ ε that minimizes the TRADES loss [58] within a 568 maximum perturbation radius of ε , and has sufficient smoothness in weight space within an ℓ 2 radius ψ aroundθ ε , there exist ε ′ >
ε and a model f θ ε ′
where || θ ε ′ − θ ε || ≤ ψ , such that f θ ε ′ has a lower TRADES loss withinε ′
when compared to f θ ε .
Justification: We first consider Adversarial Training within a perturbation bound ε using the TRADES-AWP 572 loss shown below.
[Equation]
The model f θ ε which is the minimizer of the above loss, achieves an optimal trade-off between the cross-entropy 574 loss on clean samples (clean loss, L clean ) and weighted KL divergence between clean and adversarial images[58] (adversarial loss, L adv ).
[Equation]
Since the loss attains a minima at θ ε , a direction of further reduction in both clean and adversarial losses does not 577 exist (Eq.7).
Gradient descent on the adversarial loss at θ ε to parameter θ ′ results in a reduction in adversarialloss at the cost of a higher clean loss.
[Equation]
[Equation]
We assume that L clean ,θ ε increases by a rate γ CE ,θ ε and L adv ,θ ε ,ε decreases by a rate γ KL ε ,θ ε in the direction 581 of gradient descent of the adversarial loss ( −∇L adv ,θ ε ,ε ) .
Since θ ε is a minimizer of loss,
[Equation]
Since the Cross-entropy loss is minimized at x , it attains a minima at x within the pixel neighborhood.
[Equation]
Since the model f θ is adversarially robust within ε , the loss surface is locally smooth within the open interval 584 ( − ε, ε ) .
The adversarial loss, which measures the KL divergence of the adversarial image w.r.t.
the clean imageis least at x and increases monotonically in the ε -neighborhood for adversarially robust models [3].
Therefore, 586 adversarial loss at ε ′ =
ε + δ for a small enough δ would be marginally higher than the loss at ε .
[Equation]
Based on the local smoothness in weight space as well, the same property holds at any θ ′ in the gradient descentdirection of L adv ,θ ε ,ε (satisfying Eq.9) such that || θ ′ − θ ε || ≤ ψ , as shown below:
[Equation]
[Equation]
[Equation]
[Equation]
Since the adversarial loss at θ ′ is lower than the same at θ ε , the loss surface at θ ′ has a lower local Lipschitzconstant when compared to θ ε leading to the following:
[Equation]
Rearranging terms,
[Equation]
For small enough gradient descent step size η , the above can be related to the rate of reduction in the adversarial 594 loss as shown below:
[Equation]
[Equation]
Since the Cross-entropy loss does not depend on ε , from Eq.11 and Eq.18,
[Equation]
[Equation]
Therefore, the rate of increase in L AWP ,θ ε ,ε ′ , or α − α ′ , is less than the rate of increase in L AWP ,θ ε ,ε , or α .
For small enough α , α ′ >
α , so that the overall loss L AWP ,θ ε ,ε ′ decreases.
Based on this, for small enoughη , ∃ θ ε ′ s.t. || θ ε ′ − θ ε || ≤ ψ and L AWP ,θ ε ′ ,ε ′ < L AWP ,θ ε ,ε ′ . Hence, it is possible to move to θ ε ′ which has a 599 lower overall loss than the loss at θ ε .
■
1: Input: Network f θ , Training Dataset D = { ( x i , y i ) } , Adversarial Threat model: ℓ ∞ bound of radius ε , number of epochs E, Maximum Learning Rate LR max , M training mini-batches of size n , Cross-entropy loss ℓ CE , Weight perturbation constraint M ( θ ) , coefficient of KL divergence term β 2: for epoch = 1 to E do 3: ε asc = epoch · ε/E 4:
LR = 0 .
5 · LR max · (1 + cosine
(( epoch − 1) /E
· π )) 5: for iter = 1 to M do 6: for i = 1 to n (in parallel) do 7: for steps = 1 to 2 do 8: δ = 0 .
001 · N (0 , 1) 9: δ =
[Equation]
ε asc · sign (
[Equation]
δ KL( f θ ( x i ) ||
f θ ( x i + δ ))) 10: δ =
Clamp ( δ, − ε asc , ε asc ) 11: (cid:101) x i =
Clamp ( x i + δ, 0 , 1) 12: end for 13: end for 14:
[Equation]
=
[Equation]
i
[Equation]
[Equation] [Equation]
=
[Equation] [Equation]
18: end for 19: end for
[Table]
[Table]
loss
[Table]
[Table] [Table]
with [Table] loss
[Table]
[Table]
[Table]
with
[Table]
loss
[Table]
A.3 Integrating ACAT with other efficient training methods
The proposed ACAT defense uses the KL divergence loss between clean and adversarial images, similar to the 602 TRADES adversarial training algorithm [58].
We present results by integrating the proposed ACAT defense withlosses from existing efficient adversarial training algorithms [43, 44] in Table-7.
We obtain a significant boost in 604 performance over the respective baselines, when we use ACAT with GAT [43] and TRADES [58] losses, and amarginal boost when integrated with the NuAT defense [44].
The adversarial weight perturbation step in the 606 proposed defense results in an increase in computational time when compared to the respective baselines.
Wechoose the KL divergence based loss for both proposed defenses ACAT and DAJAT since it results in an optimal 608 trade-off between performance and training time.
B Details on the proposed defense DAJAT
The algorithm of the proposed approach is presented in Algorithm-2.
In every training iteration, multiple 611 augmentations are considered for every image x i (L7).
We consider one base augmentation and T complexaugmentations.
The base augmentation consists of Pad and Crop followed by Horizontal Flip, while the complex 613 augmentations are a combination of AutoAugment [10] and the base augmentations.
The attack generation foreach augmentation (L8-L13) is similar to the ACAT algorithm discussed in Section-A.1.
The DAJAT loss (L16) 615 is a combination of the TRADES loss [58] (L17) on each augmentation, and a Jensen-Shannon (JS) divergenceterm between all augmentations.
The JS divergence is a combination of KL divergence terms with respect to the
1: Input: Network f θ , Training Dataset D = { ( x i , y i ) } , Adversarial Threat model: ℓ ∞ bound of radius ε , number of epochs E, Maximum Learning Rate LR max , M training mini-batches of size n , number of attack steps S , Cross-entropy loss ℓ CE , Weight perturbation constraint M ( θ ) ,
Number of augmented images using autoaugment T , coefficient of KL divergence term β 2: for epoch = 1 to E do 3: ε asc = epoch · ε/E 4:
LR = 0 .
5 · LR max · (1 + cosine
(( epoch − 1) /E
· π )) 5: for iter = 1 to M do 6: for i = 1 to n (in parallel) do 7: for a ∈ { base , auto(1) , . . . , auto(T) } do 8: for steps = 1 to S do 9: δ = 0 .
001 · N (0 , 1) 10: δ = δ + ε asc · sign ( ∇ δ KL( f θ ( x i,a ) ||
f θ ( x i,a + δ ))) 11:
δ =
Clamp ( δ, − ε asc , ε asc ) 12: (cid:101) x i,a = Clamp ( x i,a + δ, 0 , 1) 13: end for 14: end for 15: end for 16:
L DAJAT ( θ ) =
T + 1 · n n (cid:88) i = (cid:8) L TR ( θ, ( x i , ˜ x i ) base , y i )
+
T (cid:88) t =
L TR ( θ, ( x i , ˜ x i ) auto , y i ) (cid:9) +n n (cid:88) i = (cid:8) JSD( f θ ( x i, base ) , f θ ( x i, auto(1) ) , . . . ,
[Equation]
17: where, L TR ( θ, ( x, ˜ x ) , y ) =
L CE ( f θ ( x ) , y ) + β · KL( f θ ( x ) || f θ
[Equation]
x )) 18:
[Equation]
= argmax
[Equation] [Equation]
[Equation]
21: end for 22: end for average probability vector as shown below.
[Equation]
where M is defined as below,
[Equation]
As shown in Table-5, the JS-divergence term improves accuracy on clean samples and training convergence by 620 enabling the joint learning of representations across different augmentations.
The model weights are perturbedto ˜ θ by maximizing the TRADES loss on the base augmentations alone within the constraint set M ( θ ) (L18).
This constraint set is chosen such that ||
˜ θ l || ≤ γ · ||
θ
l
|| for any layer l .
The network ˜ θ is updated using an SGDstep to minimize the overall loss L DAJAT (˜ θ ) (L20).
The model weights are further offset by δ DAJAT which is 624 the adversarial weight perturbation at θ .
B.1 Details on Augmentations
While existing works hypothesize that augmentations changing the low-level statistics of images cannot ef- 627 fectively improve adversarial training [38], we show in this work that with the use of split Batch norm layersand JS divergence term between different augmentations, it is indeed possible to obtain significant gains using 629 augmentations that modify the low-level statistics of images as well.
In this work, we use an existing augmentation strategy, AutoAugment to obtain an improvement in performance using the proposed training algorithm
[Figure]
[Figure] [Figure]
The proposed approach achieves improvements across different sizes of training dataset, with higher gains in the low data regime
[Figure]
samples β .
Higher β leads to improved robust accuracy (against GAMA [43] attack) at the cost of clean accuracy.
ResNet-18 architecture and CIFAR-10 dataset are used.
DAJAT.
AutoAugment uses Proximal Policy Optimization to find the set of policies that can yield optimal 632 performance on a given dataset.
It consists of 25 unique sub-policies for a given dataset, where each sub-policyis a combination of two augmentations chosen from a set of pre-defined augmentations in series.
The pre-defined 634 augmentations include the spatial transformations - shear, rotation and translation, and augmentations that causechanges in low-level statistics of images - color, posterize, solarize, brightness, contrast, sharpness, autocontrast, 636 equalize and invert.
We show the impact of some of the important categories of augmentations individually in Table-8.
The robust 638 accuracy improves when the spatial augmentations - shear, rotation and translation are not used for adversarialtraining.
Amongst the augmentations that modify the low-level statistics of images, change in color balance 640 gives maximum benefit.
Further, it can be noted that although some augmentations such as change in brightnessand contrast lead to a drop in robust accuracy when used directly, the use of the same augmentations in the 642 proposed framework results in a significant boost in accuracy.
Therefore there is no need to use carefully selectedaugmentations with the proposed framework.
We visualize some of the augmentations generated using AutoAugment and Base augmentations (Pad+Crop, 645 Horizontal Flip) in Fig.4 and Fig.5 respectively.
It can be noted that multiple augmentations generated using
[Figure]
[Figure] [Figure]
[Table] [Table]
Brightness 82.
Sharpness 81.
Color-Balance 82. Contrast 82.
[Figure]
B.2 Improvements of DAJAT in the low data regime
We compare the performance of the proposed DAJAT defense (using Base, 2*AA) with TRADES-AWP [51] 656 2-step baseline across different sizes of the CIFAR-10 training dataset on ResNet-18 architecture in Fig.6.
Weconsider class balanced dataset for each case.
We note that across different settings, the proposed approach 658 achieves 5-9% gains in clean accuracy and an average gain of 1.3% in robust accuracy.
The gain in cleanaccuracy in the low data regime is significantly high (8.93%) highlighting the need for augmentations in 660 improving Adversarial Training performance, specifically in real-world settings where the training data is low.
C Details on Experiments and Results
C.1 Details on Datasets
We perform evaluations of the proposed defenses ACAT and DAJAT on the CIFAR-10, CIFAR-100 [30] and 664 ImageNette-10 [24, 12] datasets, comprising of 10, 100 and 10 classes respectively.
The resolution of images inthe CIFAR-10 and CIFAR-100 datasets is 32x32, while it is 128x128 in ImageNette dataset.
We use ResNet-18 666 [20] and WideResNet-34-10 [56] architectures for the CIFAR-10 and CIFAR-100 datasets and ResNet-18architecture for ImageNette.
While CIFAR-10 is the most popular dataset used for benchmarking adversarial 668 defenses, CIFAR-100 has a larger number of classes with one-tenth the number of images in each class, makingit a more challenging setting.
ImageNette dataset is used to show the performance of the proposed method on 670 higher resolution images.
We consider an ℓ ∞ threat model with ε = 8 / 255 for the primary evaluations acrossall datasets.
We use TRADES-AWP [51] 1 as the base code for most of our analysis.
For analysis in Table-13 weuse HAT [37] 2 and OAAT [1] 3 as the base codes.
For cutmix analysis in Table-11 we use [36] 4 as the basecode.
The license for each of these codes are available on their respective github repositories.
Since the datasets 674 used in this work are public, commonly used for research purposes and do not contain any objectionable content,we find no need to take any consent from the authors of these datasets.
C.2 Details on Training Settings
The training for the baseline methods and the proposed approach is done for 110 epochs as is common in 678 literature [34].
We use SGD optimizer along with cosine learning rate schedule for the proposed method witha momentum of 0.9.
We fix the maximum learning rate to 0.2 and weight decay to 5e-4 for the proposed 680 approach across all datasets and model architectures.
For the baselines, we use the training settings fromthe official codes released by the authors.
We performed all the experiments on two NVidia V100 and two 682 RTX-2080 GPU machines.
We use a validation split of 1000 images from the train dataset both for CIFAR-10and CIFAR-100 images, except for the results reported in Table-4, where we use the full dataset to compare 684 against the state-of-the-art defenses on the RobustBench leaderboard [9].
For the proposed approaches ACAT and DAJAT (Base, 2*AA), we vary the value of β to achieve an optimal 686 trade-off between the clean and adversarial accuracy.
As shown in Fig.7 and Fig.11(a,b), as we increase β ,robust accuracy improves and clean accuracy degrades initially, with a saturating trend in robust accuracy at
[Table]
[Table]
We further fix the value of β to the optimal setting of 9 and vary the coefficient of the JS divergence term in 691 Fig.11(c,d).
This term leads to a boost in the clean accuracy at the cost of a slight degradation in the robustaccuracy.
The optimal setting of the coefficient of JS divergence term is 2 in the given setting (Base, 2*AA) and 693 ranges from 1 to 3 across all settings, datasets and model architectures.
We consider the Base, 2*AA as the main setting of DAJAT since its computational complexity matches with 695 that of TRADES-AWP.
However, we show the result of Base, 3*AA as well to highlight that the performanceimproves with a further increase in diversity.
In this case, since the weight of the Base augmentations is 697 considerably low in the overall loss (L16 in Algorithm-2), we give a weight of 1/3 to the TRADES loss on baseaugmentations and 2/3 to the TRADES loss on the AutoAugment based images.
This mimics the setting of Base, 699 2*AA in terms of loss weighting, while introducing additional diversity due to the presence of a larger numberof complex augmentations, yielding a small boost in performance.
We share the optimal set of hyperparameters across all datasets and model architectures in the ReadMe file that 702 is submitted along with our Code in the Supplementary submission.
C.3 Variance across reruns
We present the variation across three reruns for the proposed defenses ACAT and DAJAT (Base, 2*AA) on 705 CIFAR-10 dataset and ResNet-18 architecture in Table-9.
Since weight averaging is known to improve thestability of the base method [44], we present results without the use of weight averaging to highlight the inherent 707 variance of the base algorithm.
The standard deviation of robust accuracy across reruns is low (0.06-0.07) acrossboth approaches indicating stability of the proposed method.
It can be noted that the standard deviation of 709 clean accuracy in the proposed defense DAJAT is slightly higher (0.1) due to the randomness in the complexaugmentations, which impacts clean accuracy more than the robust accuracy.
Overall, we note that the standard 711 deviation of clean and robust accuracy for both proposed defences ACAT and DAJAT is low .
C.4 Comparison against CutMix based augmentation
While we compare the performance of the proposed approach against various base adversarial training algorithms 714 [51, 32, 34, 44] in the main paper, we additionally compare with a recent augmentation scheme that uses CutMixaugmentations [38] to improve performance in this section.
The authors [38] show a significant boost in 716 performance using 400 epochs of training and large model architectures.
However, to ensure a fair comparison,we report the result of 110 epochs of training on WideResNet-34-10 architecture and CIFAR-10 dataset that has
[Table] [Table]
been shared by the authors with us upon request.
We report the PGD 40-step accuracy as shared by the authors.
As shown in Table-10, we obtain a significant boost in performance over the CutMix based augmentation as wellas the TRADES-AWP [51] baseline using the proposed defense DAJAT.
Additionally, contrary to the claims by Rebuffi et al.
[38], we show that it is indeed possible to effectively use 722 augmentations that modify the low-level statistics of images for obtaining improved performance in Adversarial
Training by using the proposed defense DAJAT.
As present in the github repository 5 of [38] we note that naively using cutmix doesn’t give good results as shownin Table-6, therefore as suggested we use [36] as the base code and incorporate cutmix into it.
We present the 726 results for 200 epochs training with learning rate drop of 0.1 at 100 and 150 epochs, using the PreActResNet-18model with Swish Activation and batch size of 128 in Table-11(C1).
We observe significantly improved results 728 as compared to Table-6 on using [36] as the base code.
We observe that the key differences in [36] as comparedto [58] are:
• Use of swish activation function in the PreActResNet18 model• Weight decay not used for batch normalization layers
To study the impact of these changes, we investigate the use ReLU instead of Swish activation (Table-11(C5)) 733 and the use of weight decay for all the parameters of the model including the batch normalization layers(Table-11(C6)).
In both cases, we observe a significant drop with respect to C1.
Thus based on this ablation, the 735 use of swish activation, and avoiding weight decay for batch normalization layers seems important to obtainbenefits using Cutmix.
Further we incorporate linearly increasing varying epsilon schedule along with cosine learning rate schedule and 738 get improved results in Table-11(C2).
Next we incorporated our method DAJAT with C2 and present the resultsin Table-11(C3,C5), where we can observe significant gains over C2, thus showing the effectiveness of DAJAT.
C.5 Comparison of DAJAT with Concurrent Works
Here we compare the proposed approach DAJAT trained for 200 epochs with recent works that appeared at ICLR 742 2022.
The comparison of the proposed method DAJAT with AWP [51], HAT [37], Self Ensemble Adversarial
Training (SEAT) [48] with (SEAT+cutmix) and without cutmix (SEAT), Unified distributional robustness for 744 TRADES (UDR + TRADES) [5], temporal ensembling with TRADES (TRADES + TE) [14] on CIFAR10 and
CIFAR100 datasets for ResNet18 and WideResNet-34-10 models is shown in Table-12.
Since these are very 746 recent works, we only present results reported in the paper, and leave the remaining entries in the table blank.
[Table]
[Figure]
R o b u s t
A cc u r a c y ( % )
[Figure]
[Figure]
[Figure]
[Figure]
A v
[Figure]
r a g e
L o ss
[Figure]
C.6 Combining the proposed approach with different adversarial training methods
We explore combining the proposed defense DAJAT with some existing methods like [51], [1] and [37] in 749 Table-13.
We observe that combining DAJAT with all three existing works leads to significant gains both inclean as well as adversarial accuracies (AA, 8/255), especially on CIFAR-100 where the number of images per 751 class is low.
Although OAAT [1] shows improved results over AWP [51], combining DAJAT with OAAT leadsto further gains of ∼ 1 .
5% in both clean and adversarial accuracy on CIFAR10 and 1 − 1 .
5% gains in both cleanand adversarial accuracy on CIFAR100.
Further, since OAAT [1] claims to achieve robustness at larger epsilon 754 bounds, we evaluate using Auto-Attack at ε = 16 / 255 .
Using OAAT+DAJAT we observe gains over OAAT on
AutoAttack with ε = 16 / 255 as well, which further confirms the effectiveness of DAJAT.
Finally we combine 756 DAJAT with HAT [37] and we observe consistent gains over HAT [37] on all models and datasets.
While HAT[37] proposes to improve the robustness-accuracy trade-off, combining DAJAT with HAT further improves this 758 trade-off and shows gains of ∼ 1% on clean accuracy and ∼ 2% on robust accuracy for CIFAR-10, and 3 − 5%on clean accuracy and ∼ 3% on robust accuracy for CIFAR-100 dataset.
[Figure]
[Table] [Table]
C.7 Sanity checks to verify the absence of gradient masking
We perform several sanity checks as recommended by Athalye et al.
[3] to ensure the absence of gradient 762 masking in the proposed defenses ACAT
and DAJAT.
[Table]
• From Table-14 we note that Black-Box attacks are weaker than White-Box attacks, indicating that thegradients from the model are reliable.
• We further note from Table-14 that attacks with higher number of steps are stronger than those withlower steps.
Further, PGD multi-step attacks are stronger than FGSM white-box attacks.• From Table-15 we note that robust accuracy against targeted and untargeted attacks saturates as thenumber of attack steps increase from 500 to 1000, indicating that the evaluation is robust.
[Table]
• We also note from Table-15 that the drop in accuracy with 1000 random restarts is marginal.
[Table] • We note from Fig.12 that an increase in perturbation bound increases the effectiveness of PGD 7-stepattacks, and is able to bring down the accuracy of the model to 0 at large bounds.
Further, the loss onFGSM samples monotonically increases in the vicinity of the data samples.
These trends indicate the [Table] absence of gradient masking.
[Table]
• We present results against AutoAttack [8] in Tables-2 and 3 of the main paper.
AutoAttack is anensemble of several gradient-based attacks and a gradient-free attack Square [2].
The robust accuracyagainst AutoAttack is similar to the accuracy against gradient-based attack GAMA [43] indicatingthat gradient-free attacks are not significantly stronger than gradient based attacks.
[Table]
• We show the loss surface plots of the proposed defenses ACAT and DAJAT in the vicinity of datasamples in Fig.13.
We note that the loss surface of the proposed defenses is smooth similar to theTRADES-AWP defense, indicating the absence of gradient masking.
We finally compare the robust accuracy against various attacks in Tables-14 and 15 with the robust accuracy 782 against GAMA attack [43] and AutoAttack [8] in Tables-2 and 3 in the main paper.
The latter evaluations aresignificantly stronger, indicating that the evaluation presented in the main paper is robust.
D Additional Results for Rebuttal
In this section, we present additional plots and figures to support our rebuttal.
[Figure] [Figure]
[Figure]
accuracy against PGD-20 [32] attack are plotted on CIFAR-10 dataset using ResNet-18 (a,b) and WideResNet34-10 (c,d) architectures.
Although DAJAT+Fixed- ε is stable at lower model capacities (ResNet-18), there is a sudden drop in the robust accuracy due to Gradient masking on WideResNet-34-10 (c,d) after epoch 87, indicating the need for using varying ε schedule in DAJAT.
Evaluations are done using an attack perturbation bound of ε = 8 / 255 .
[Figure]
When Pad+Crop+HFlip is applied in series after AutoAugment, the distribution of these images shifts to the left, leading to an overlap in the two distributions.
The role of the "complex" batch-norm layer is to allow the learning of a function that minimizes empirical risk across a wide distribution of data.
The use of a separate batch-norm layer for "simple" augmentations allows the network to specialize on a select subset that is close to the distribution of test set images, and has a low variance.
The full test set of CIFAR-10 (10k images) is used for the plots