[论文解读] Overfitting in adversarially robust deep learning

Leslie Rice, Eric Wong+1 more|arXiv (Cornell University)|Feb 26, 2020

Adversarial Robustness in Machine Learning参考文献 72被引用 46

一句话总结

该论文表明，在跨多个数据集和威胁模型的对抗性训练中，鲁棒性过拟合普遍存在，并且早停通常能够达到或超过最先进的对抗训练方法。当训练达到收敛时，正则化和数据增强提供的改进有限。

ABSTRACT

It is common practice in deep learning to use overparameterized networks and train for as long as possible; there are numerous studies that show, both theoretically and empirically, that such practices surprisingly do not unduly harm the generalization performance of the classifier. In this paper, we empirically study this phenomenon in the setting of adversarially trained deep networks, which are trained to minimize the loss under worst-case adversarial perturbations. We find that overfitting to the training set does in fact harm robust performance to a very large degree in adversarially robust training across multiple datasets (SVHN, CIFAR-10, CIFAR-100, and ImageNet) and perturbation models ($\ell_\infty$ and $\ell_2$). Based upon this observed effect, we show that the performance gains of virtually all recent algorithmic improvements upon adversarial training can be matched by simply using early stopping. We also show that effects such as the double descent curve do still occur in adversarially trained models, yet fail to explain the observed overfitting. Finally, we study several classical and modern deep learning remedies for overfitting, including regularization and data augmentation, and find that no approach in isolation improves significantly upon the gains achieved by early stopping. All code for reproducing the experiments as well as pretrained model weights and training logs can be found at https://github.com/locuslab/robust_overfitting.

研究动机与目标

• 证明在对抗性训练的网络中会出现过拟合，并损害鲁棒性能。
• 表征学习率计划和模型复杂度如何影响鲁棒性过拟合。
• 评估经典与现代的补救措施（正则化、数据增强、半监督学习）以缓解鲁棒性过拟合。
• 表明早停可以匹配或超过近期对抗训练改进的鲁棒性提升。

提出的方法

• 在 SVHN、CIFAR-10/100 和 ImageNet 上进行对抗鲁棒模型的经验训练。
• 在不同学习率计划下分析鲁棒测试误差随训练进展的变化。
• 比较原始的 PGD、TRADES 及其他算法。
• 对正则化、数据增强和半监督学习进行消融研究。
• 使用保留验证集进行早停并验证其对鲁棒性能的影响。

实验结果

研究问题

• RQ1 对抗性训练网络是否会过拟合，及其对鲁棒测试性能的影响如何？
• RQ2 哪些学习率计划和模型复杂度会影响鲁棒性过拟合？
• RQ3 正则化、数据增强或半监督方法是否能够缓解鲁棒性过拟合，它们与早停相比如何？
• RQ4 早停是否足以匹配或超过更新颖对抗训练技术的鲁棒性增益？

主要发现

• 鲁棒性过拟合是对抗性训练中的主导现象，随着学习率衰减和继续训练，鲁棒测试误差会增加。
• 早停可以匹配或超过最先进的对抗训练增益；在 CIFAR-10 上，带早停的原始 PGD 可以达到与 TRADES 相当的鲁棒性能。
• 更平滑的学习率计划并不能防止鲁棒性过拟合；分段离散衰减在训练过程中的鲁棒性能最佳。
• 在训练收敛时，显式正则化和标准数据增强提供的改进有限；与早停结合的半监督增强在早停时可有所帮助。
• 增加模型容量在鲁棒测试性能上有提升，尽管存在鲁棒性过拟合，表明双峰下降和鲁棒性过拟合是不同的现象。