[Paper Review] Improving Fast Adversarial Training with Prior-Guided Knowledge

Xiaojun Jia, Yong Zhang+5 more|arXiv (Cornell University)|Apr 1, 2023

Adversarial Robustness in Machine Learning4 citations

TL;DR

This paper proposes FGSM-PGK, a fast adversarial training method that prevents catastrophic overfitting by leveraging prior-guided knowledge—specifically, high-quality adversarial perturbations and model weights from historical training. By improving adversarial example quality through prior-guided initialization and regularization, the method achieves state-of-the-art robustness with minimal additional training cost across four datasets.

ABSTRACT

Fast adversarial training (FAT) is an efficient method to improve robustness. However, the original FAT suffers from catastrophic overfitting, which dramatically and suddenly reduces robustness after a few training epochs. Although various FAT variants have been proposed to prevent overfitting, they require high training costs. In this paper, we investigate the relationship between adversarial example quality and catastrophic overfitting by comparing the training processes of standard adversarial training and FAT. We find that catastrophic overfitting occurs when the attack success rate of adversarial examples becomes worse. Based on this observation, we propose a positive prior-guided adversarial initialization to prevent overfitting by improving adversarial example quality without extra training costs. This initialization is generated by using high-quality adversarial perturbations from the historical training process. We provide theoretical analysis for the proposed initialization and propose a prior-guided regularization method that boosts the smoothness of the loss function. Additionally, we design a prior-guided ensemble FAT method that averages the different model weights of historical models using different decay rates. Our proposed method, called FGSM-PGK, assembles the prior-guided knowledge, i.e., the prior-guided initialization and model weights, acquired during the historical training process. Evaluations of four datasets demonstrate the superiority of the proposed method.

Motivation & Objective

• To investigate the root cause of catastrophic overfitting in fast adversarial training (FAT) and identify its link to adversarial example quality.
• To reduce training costs while maintaining or improving adversarial robustness in FAT, especially compared to standard adversarial training with multi-step attacks.
• To develop a method that leverages historical training knowledge—such as adversarial perturbations and model weights—without requiring additional forward passes during training.
• To ensure robustness across diverse attack strengths and evaluation settings, particularly under strong ℓ∞ attacks.
• To theoretically and empirically validate that improved adversarial example quality leads to smoother loss landscapes and better generalization.

Proposed method

• Proposes prior-guided initialization using high-quality adversarial perturbations extracted from historical training steps to enhance the initial adversarial examples in fast training.
• Introduces a prior-guided regularization method that combines prior and adversarial perturbations to smooth the loss function and improve robustness to both types of perturbations.
• Designs a prior-guided ensemble method that dynamically averages model weights from historical checkpoints using different decay rates to improve generalization.
• Employs a mini-max optimization framework where the inner maximization step uses a single-step FGSM attack, but with improved initialization and regularization to prevent performance collapse.
• The method integrates three components: prior-guided initialization, prior-guided regularization, and prior-guided weight averaging, forming the FGSM-PGK framework.
• Theoretical analysis supports the effectiveness of the proposed initialization in maintaining adversarial robustness during training.

Experimental results

Research questions

• RQ1 Why does catastrophic overfitting occur in fast adversarial training, and is it related to the quality of adversarial examples?
• RQ2 Can historical training data be leveraged to improve adversarial example quality without increasing training cost?
• RQ3 How does prior-guided initialization compare to standard FGSM-AT in preventing robustness degradation over time?
• RQ4 Does combining prior-guided knowledge (initialization, regularization, and model weights) lead to better robustness than using individual components?
• RQ5 How does the proposed method perform under varying ℓ∞ attack strengths and different datasets?

Key findings

• FGSM-PGK prevents catastrophic overfitting on CIFAR-10, SVHN, Tiny ImageNet, and ImageNet-100, even under strong ℓ∞ attacks (e.g., 14/255), while previous methods like NuAT fail.
• The method achieves state-of-the-art PGD-10 robust accuracy on CIFAR-10 with ResNet-18, outperforming both fast and standard adversarial training baselines.
• Using only prior-guided initialization already prevents overfitting and improves robustness, but combining it with regularization and weight averaging yields the best performance with minimal extra training time.
• The loss landscape of FGSM-PGK shows greater linearity in the adversarial direction compared to prior methods, indicating flatter and more robust loss profiles.
• The prior-guided regularization method improves loss smoothness, which correlates with enhanced robustness to both prior and adversarial perturbations.
• The proposed method achieves superior robustness with training time comparable to standard FGSM-AT, making it efficient and practical for real-world deployment.