[Paper Review] Bag of Tricks for FGSM Adversarial Training

Zichao Li, Li Liu+3 more|arXiv (Cornell University)|Sep 6, 2022

Adversarial Robustness in Machine Learning4 citations

TL;DR

This paper introduces a bag of practical, computationally efficient tricks to stabilize Fast Gradient Sign Method adversarial training (FGSM-AT), which suffers from catastrophic overfitting. By applying simple modifications—such as fixed pixel masking, large convolutional strides, smooth activation functions, or first-layer weight regularization—FGSM-AT achieves robust accuracy of 49.8% against PGD-50 and 46.4% against AutoAttack on CIFAR-10 with PreActResNet-18, proving pure FGSM-AT can yield robust models without complex attacks or high computational cost.

ABSTRACT

Adversarial training (AT) with samples generated by Fast Gradient Sign Method (FGSM), also known as FGSM-AT, is a computationally simple method to train robust networks. However, during its training procedure, an unstable mode of "catastrophic overfitting" has been identified in arXiv:2001.03994 [cs.LG], where the robust accuracy abruptly drops to zero within a single training step. Existing methods use gradient regularizers or random initialization tricks to attenuate this issue, whereas they either take high computational cost or lead to lower robust accuracy. In this work, we provide the first study, which thoroughly examines a collection of tricks from three perspectives: Data Initialization, Network Structure, and Optimization, to overcome the catastrophic overfitting in FGSM-AT. Surprisingly, we find that simple tricks, i.e., a) masking partial pixels (even without randomness), b) setting a large convolution stride and smooth activation functions, or c) regularizing the weights of the first convolutional layer, can effectively tackle the overfitting issue. Extensive results on a range of network architectures validate the effectiveness of each proposed trick, and the combinations of tricks are also investigated. For example, trained with PreActResNet-18 on CIFAR-10, our method attains 49.8% accuracy against PGD-50 attacker and 46.4% accuracy against AutoAttack, demonstrating that pure FGSM-AT is capable of enabling robust learners. The code and models are publicly available at https://github.com/UCSC-VLAA/Bag-of-Tricks-for-FGSM-AT.

Motivation & Objective

• Address the instability of FGSM-AT caused by catastrophic overfitting, where robust accuracy collapses to zero within a single training step.
• Develop lightweight, computationally efficient solutions to stabilize FGSM-AT without relying on expensive adversarial attacks like PGD.
• Investigate whether randomness in data initialization is essential for stabilizing FGSM-AT, challenging prior assumptions.
• Explore architectural and optimization-level modifications that inherently improve training stability in FGSM-AT.
• Demonstrate that pure FGSM-AT, when stabilized with simple techniques, can achieve competitive robustness comparable to more complex adversarial training methods.

Proposed method

• Propose FGSM-Mask: masking a fixed or random subset of input pixels during FGSM-AT training to stabilize optimization.
• Introduce FGSM-Str2: increasing the stride size of the first convolutional layer to reduce feature overlap and improve stability.
• Apply smooth activation functions (e.g., SiLU) in place of ReLU to reduce gradient sharpness and mitigate overfitting.
• Introduce ConvNorm: a weight regularization term that constrains the L2 norm of the first convolutional layer’s weights to stabilize training.
• Combine multiple tricks (e.g., large stride + smooth activation + ConvNorm) to achieve synergistic improvements in robustness.
• Use a fixed masking pattern instead of random masking, showing that randomness is not essential for stabilization.

Experimental results

Research questions

• RQ1 Can fixed, non-random pixel masking stabilize FGSM-AT training, challenging the belief that randomness is necessary for robustness?
• RQ2 Does increasing the stride of the first convolutional layer improve the stability of FGSM-AT in CNNs?
• RQ3 Can smooth activation functions such as SiLU reduce catastrophic overfitting in FGSM-AT compared to ReLU?
• RQ4 Can a lightweight weight regularization on the first convolutional layer (ConvNorm) stabilize FGSM-AT without significant computational overhead?
• RQ5 Do combinations of these tricks lead to better robustness than individual methods on standard benchmarks like CIFAR-10 and CIFAR-100?

Key findings

• FGSM-AT with fixed pixel masking (FGSM-Mask-Fixed) achieves 49.8% robust accuracy against PGD-50 and 46.4% against AutoAttack on CIFAR-10 using PreActResNet-18.
• Using a large stride (Str2) in the first convolutional layer stabilizes training and enables 50.4% robust accuracy against PGD-50-10 and 47.3% against AutoAttack on WideResNet-34-10.
• Smooth activation functions (e.g., SiLU) improve stability, achieving 25.2% robust accuracy against AutoAttack on CIFAR-100 with FGSM-Smooth.
• ConvNorm, a lightweight weight regularization on the first layer, stabilizes training and achieves 25.1% robust accuracy against AutoAttack on CIFAR-100.
• Combinations of tricks (e.g., Str2 + smooth activation + ConvNorm) yield the highest robustness, reaching 50.4% against PGD-50-10 on WideResNet-34-10.
• All proposed methods prevent catastrophic overfitting even under large perturbations (ε = 16/255), with FGSM-Mask achieving 25.3% robust accuracy against PGD-50-10 on CIFAR-10.