[Paper Review] Geometry-aware Instance-reweighted Adversarial Training

Jingfeng Zhang, Jianing Zhu+4 more|arXiv (Cornell University)|Oct 5, 2020

Adversarial Robustness in Machine Learning55 references31 citations

TL;DR

GAIRAT assigns instance-dependent weights to adversarial examples based on how close natural data are to the decision boundary, improving robustness with little to no loss in accuracy; when combined with FAT, it can boost both robustness and standard accuracy.

ABSTRACT

In adversarial machine learning, there was a common belief that robustness and accuracy hurt each other. The belief was challenged by recent studies where we can maintain the robustness and improve the accuracy. However, the other direction, whether we can keep the accuracy while improving the robustness, is conceptually and practically more interesting, since robust accuracy should be lower than standard accuracy for any model. In this paper, we show this direction is also promising. Firstly, we find even over-parameterized deep networks may still have insufficient model capacity, because adversarial training has an overwhelming smoothing effect. Secondly, given limited model capacity, we argue adversarial data should have unequal importance: geometrically speaking, a natural data point closer to/farther from the class boundary is less/more robust, and the corresponding adversarial data point should be assigned with larger/smaller weight. Finally, to implement the idea, we propose geometry-aware instance-reweighted adversarial training, where the weights are based on how difficult it is to attack a natural data point. Experiments show that our proposal boosts the robustness of standard adversarial training; combining two directions, we improve both robustness and accuracy of standard adversarial training.

Motivation & Objective

• Motivate that with limited model capacity, adversarial data should not be treated equally in training.
• Propose a geometry-aware, instance-reweighted objective to emphasize attackable data near the decision boundary.
• Show that GAIRAT alleviates robust overfitting and improves robustness with minimal accuracy loss.
• Demonstrate GAIRAT's compatibility with existing AT variants and its empirical gains on standard benchmarks.

Proposed method

• Introduce GAIRAT with an instance-weighted loss: min_theta (1/n) sum_i w(x_i,y_i) ell(f_theta(x_i~), y_i) where x_i~ is the adversarial variant.
• Approximate data geometry using the least number of PGD iterations κ(x,y) needed to fool the current model.
• Define weight function w based on κ (e.g., a non-increasing function of κ) to emphasize data near the boundary.
• Use GA-PGD to generate adversarial examples and compute κ during training (Algorithm 1).
• Apply GAIRAT within existing AT frameworks (AT, FAT, TRADES) to obtain GAIR-AT, GAIR-FAT, and GAIR-TRADES variants.

Experimental results

Research questions

• RQ1 Can instance-wise reweighting based on geometric distance to the decision boundary improve robustness without sacrificing standard accuracy?
• RQ2 Does GAIRAT mitigate robust overfitting observed in minimax adversarial training?
• RQ3 How does GAIRAT interact with and improve existing adversarial training methods like AT, FAT, and TRADES?
• RQ4 What are the empirical gains of GAIRAT on standard benchmarks (e.g., CIFAR-10 with Wide ResNet) compared to baselines?

Key findings

• GAIRAT relieves robust overfitting and improves adversarial robustness with little degradation to natural accuracy.
• GAIR-FAT (GAIR-enhanced FAT) improves both robustness and accuracy compared to FAT and AT baselines.
• On Wide ResNet-32-10 with CIFAR-10, GAIRAT and GAIR-FAT show substantial robustness gains over AT and FAT in PGD-20 and PGD+ evaluations.
• GAIRAT achieves better adversarial robustness while maintaining comparable natural accuracy, challenging the robustness-accuracy trade-off.
• GAIRAT is compatible with FAT and TRADES, enabling combined gains (GAIR-FAT, GAIR-TRADES).