[Paper Review] Consistency Regularization for Adversarial Robustness

Jihoon Tack, Sihyun Yu+4 more|arXiv (Cornell University)|Mar 8, 2021

Adversarial Robustness in Machine Learning4 citations

TL;DR

This paper proposes a consistency regularization technique that improves adversarial robustness by enforcing predictive similarity between adversarial examples derived from two different augmentations of the same input. By leveraging data augmentation and forcing consistency in attack directions, the method significantly reduces robust overfitting, boosting robust accuracy by up to 6.74 percentage points on CIFAR-10 and improving generalization to unseen adversaries.

ABSTRACT

Adversarial training (AT) is currently one of the most successful methods to obtain the adversarial robustness of deep neural networks. However, the phenomenon of robust overfitting, i.e., the robustness starts to decrease significantly during AT, has been problematic, not only making practitioners consider a bag of tricks for a successful training, e.g., early stopping, but also incurring a significant generalization gap in the robustness. In this paper, we propose an effective regularization technique that prevents robust overfitting by optimizing an auxiliary `consistency' regularization loss during AT. Specifically, we discover that data augmentation is a quite effective tool to mitigate the overfitting in AT, and develop a regularization that forces the predictive distributions after attacking from two different augmentations of the same instance to be similar with each other. Our experimental results demonstrate that such a simple regularization technique brings significant improvements in the test robust accuracy of a wide range of AT methods. More remarkably, we also show that our method could significantly help the model to generalize its robustness against unseen adversaries, e.g., other types or larger perturbations compared to those used during training. Code is available at https://github.com/alinlab/consistency-adversarial.

Motivation & Objective

• To address robust overfitting in adversarial training, where model robustness degrades during training despite optimization.
• To reduce the generalization gap in adversarial robustness between training and test sets.
• To improve robustness against unseen adversaries, such as larger perturbations or different attack types not seen during training.
• To develop a simple, plug-in regularization technique compatible with existing adversarial training frameworks.
• To demonstrate that data augmentation, when combined with consistency regularization, injects useful inductive bias for robustness.

Proposed method

• The method applies data augmentation (specifically AutoAugment) to generate two distinct augmentations of the same input.
• For each augmented input, an adversarial example is generated using a PGD attack with a specified perturbation budget.
• A consistency regularization loss is introduced to minimize the KL divergence between the model’s predictive distributions on the two adversarial examples.
• The loss function encourages the model to produce similar predictions for adversarial examples derived from different augmentations of the same sample.
• The regularization is applied alongside standard adversarial training loss, making it compatible with any AT method.
• The attack direction is shown to encode 'dark knowledge'—the most confusing class for a clean input—making consistency in attack directions informative.

Experimental results

Research questions

• RQ1 Can consistency regularization between adversarially perturbed augmentations reduce robust overfitting in adversarial training?
• RQ2 Does enforcing prediction consistency across different augmentations improve generalization to unseen adversaries?
• RQ3 How effective is data augmentation in mitigating robust overfitting when combined with consistency regularization?
• RQ4 What is the impact of consistency regularization on corruption robustness (e.g., CIFAR-10-C)?
• RQ5 Can the proposed method be effectively applied to various AT frameworks without architectural changes?

Key findings

• The proposed method improved the robust accuracy of standard adversarial training on CIFAR-10 from 44.86% to 56.38% under PGD-100 attack with ε=8/255.
• On CIFAR-100, the method increased robust accuracy from 29.74% to 37.81% under the same attack setting.
• The method reduced mean corruption error (mCE) from 24.03% to 22.06% on CIFAR-10, indicating improved robustness to distribution shift.
• In low-data regimes (10% of training data), the method achieved 41.2% robust accuracy, outperforming AWP (34.7%) and demonstrating data efficiency.
• The model showed improved generalization to unseen adversaries, including larger perturbations and different threat models.
• 77.45% of misclassified adversarial examples predicted the most confusing class, validating that attack directions encode meaningful 'dark knowledge'.