[Paper Review] Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examples

Sven Gowal, Chongli Qin+3 more|arXiv (Cornell University)|Oct 7, 2020

Adversarial Robustness in Machine Learning91 references144 citations

TL;DR

The paper conducts a systematic study of adversarial training to uncover its limits and shows that combining larger models, Swish/SiLU activations, and model weight averaging yields substantial robustness gains, especially with unlabeled data.

ABSTRACT

Adversarial training and its variants have become de facto standards for learning robust deep neural networks. In this paper, we explore the landscape around adversarial training in a bid to uncover its limits. We systematically study the effect of different training losses, model sizes, activation functions, the addition of unlabeled data (through pseudo-labeling) and other factors on adversarial robustness. We discover that it is possible to train robust models that go well beyond state-of-the-art results by combining larger models, Swish/SiLU activations and model weight averaging. We demonstrate large improvements on CIFAR-10 and CIFAR-100 against $\ell_\infty$ and $\ell_2$ norm-bounded perturbations of size $8/255$ and $128/255$, respectively. In the setting with additional unlabeled data, we obtain an accuracy under attack of 65.88% against $\ell_\infty$ perturbations of size $8/255$ on CIFAR-10 (+6.35% with respect to prior art). Without additional data, we obtain an accuracy under attack of 57.20% (+3.46%). To test the generality of our findings and without any additional modifications, we obtain an accuracy under attack of 80.53% (+7.62%) against $\ell_2$ perturbations of size $128/255$ on CIFAR-10, and of 36.88% (+8.46%) against $\ell_\infty$ perturbations of size $8/255$ on CIFAR-100. All models are available at https://github.com/deepmind/deepmind-research/tree/master/adversarial_robustness.

Motivation & Objective

• Assess the effectiveness and limits of adversarial training for robustness to norm-bounded perturbations.
• Investigate how training losses, model size, activation functions, unlabeled data, and weight averaging affect robust accuracy.
• Identify combinations of factors that significantly improve state-of-the-art robustness on CIFAR-10/100 and MNIST.

Proposed method

• Formulate and evaluate adversarial training variants using inner/outer optimization losses.
• Compare standard AT, TRADES, and MART losses with different inner maximization strategies.
• Experiment with model scaling (depth/width) and activation functions (Swish/SiLU).
• Incorporate unlabeled data via pseudo-labeling from 80 Million Tiny Images and vary labeled/unlabeled ratios.
• Apply model weight averaging during training and evaluate its impact on robustness.
• Assess robustness using strong attacks (AutoAttack and MultiTargeted) and early stopping based on validation robust accuracy.

Experimental results

Research questions

• RQ1 What are the limits of current adversarial training approaches under norm-bounded perturbations?
• RQ2 How do inner/outer loss choices affect robustness and clean accuracy across data regimes?
• RQ3 Does unlabeled data and pseudo-labeling improve robust performance, and how should it be integrated?
• RQ4 How do model capacity (depth/width) and activation functions influence robustness?
• RQ5 Can weight averaging provide consistent robustness gains across settings?

Key findings

• TRADES with early stopping often outperforms classical adversarial training in robustness on CIFAR-10 with and without unlabeled data.
• Increasing model capacity (depth/width) generally improves robustness, with deeper models sometimes outperforming larger parameter counts.
• Swish/SiLU activations yield robustness benefits, while other smooth activations do not necessarily help.
• Unlabeled data via pseudo-labeling can boost robustness, with an optimal labeled-to-unlabeled data ratio about 3:7 in their setup.
• Model weight averaging consistently improves robustness, sometimes matching TRADES gains in low-data settings.
• Their best CIFAR-10 results reach 65.88% robust accuracy against 8/255 L-infinity perturbations with unlabeled data, and 57.20% without; CIFAR-10 under L2-128/255 reaches 80.53% robust accuracy, etc. (values pulled from the text for context).