最近,Wong等人。表明,使用单步FGSM的对抗训练导致一种名为灾难性过度拟合(CO)的特征故障模式,其中模型突然变得容易受到多步攻击的影响。他们表明,在FGSM(RS-FGSM)之前添加随机扰动似乎足以防止CO。但是,Andriushchenko和Flammarion观察到RS-FGSM仍会导致更大的扰动,并提出了一个昂贵的常规化器(Gradalign),DEMATER(GARGALIGN)DES昂贵(Gradalign)Dust Forrasiniger(Gradalign)Dust co避免在这项工作中,我们有条不紊地重新审视了噪声和剪辑在单步对抗训练中的作用。与以前的直觉相反,我们发现在干净的样品周围使用更强烈的噪声与不剪接相结合在避免使用大扰动半径的CO方面非常有效。基于这些观察结果,我们提出了噪声-FGSM(N-FGSM),尽管提供了单步对抗训练的好处,但在大型实验套件上没有经验分析,这表明N-FGSM能够匹配或超越以前的单步方法的性能,同时达到3 $ \ times $加速。代码可以在https://github.com/pdejorge/n-fgsm中找到
translated by 谷歌翻译
尽管在构建强大的神经网络方面具有明显的计算优势,但使用单步方法的对抗训练(AT)是不稳定的,因为它遭受了灾难性的过度拟合(CO):网络在对抗性训练的第一阶段获得了非平凡的鲁棒性,但突然达到了一个阶段在几次迭代中,他们很快失去了所有鲁棒性。尽管有些作品成功地预防了CO,但导致这种显着失败模式的不同机制仍然很少理解。但是,在这项工作中,我们发现数据结构与AT动力学之间的相互作用在CO中起着基本作用。特别是,通过对自然图像的典型数据集进行主动干预,我们建立了一个因果关系。在方法上单步中的数据和CO的发作。这种新的观点提供了对导致CO的机制的重要见解,并为更好地理解强大模型构建的一般动态铺平了道路。可以在https://github.com/gortizji/co_features上找到复制本文实验的代码。
translated by 谷歌翻译
虽然多步逆势培训被广泛流行作为对抗强烈的对抗攻击的有效防御方法,但其计算成本与标准培训相比,其计算成本是众所周知的。已经提出了几种单步侵权培训方法来减轻上述开销费用;但是,根据优化设置,它们的性能并不能充分可靠。为了克服这些限制,我们偏离了现有的基于输入空间的对抗性培训制度,并提出了一种单步潜在培训方法(SLAT),其利用潜在的代表梯度作为潜在的对抗扰动。我们证明,与所采用的潜伏扰动,恢复局部线性度并确保与现有的单步逆势训练方法相比,恢复局部线性度并确保可靠性的特征梯度的L1规范。因为潜伏的扰动基于可以在输入梯度计算过程中免费获得的潜在表示的梯度,所以所提出的方法与快速梯度标志方法相当成本。实验结果表明,尽管其结构简单,但优于最先进的加速的对抗训练方法。
translated by 谷歌翻译
Adversarial training, a method for learning robust deep networks, is typically assumed to be more expensive than traditional training due to the necessity of constructing adversarial examples via a first-order method like projected gradient decent (PGD). In this paper, we make the surprising discovery that it is possible to train empirically robust models using a much weaker and cheaper adversary, an approach that was previously believed to be ineffective, rendering the method no more costly than standard training in practice. Specifically, we show that adversarial training with the fast gradient sign method (FGSM), when combined with random initialization, is as effective as PGD-based training but has significantly lower cost. Furthermore we show that FGSM adversarial training can be further accelerated by using standard techniques for efficient training of deep networks, allowing us to learn a robust CIFAR10 classifier with 45% robust accuracy to PGD attacks with = 8/255 in 6 minutes, and a robust ImageNet classifier with 43% robust accuracy at = 2/255 in 12 hours, in comparison to past work based on "free" adversarial training which took 10 and 50 hours to reach the same respective thresholds. Finally, we identify a failure mode referred to as "catastrophic overfitting" which may have caused previous attempts to use FGSM adversarial training to fail. All code for reproducing the experiments in this paper as well as pretrained model weights are at https://github.com/locuslab/fast_adversarial.
translated by 谷歌翻译
深度神经网络很容易被称为对抗攻击的小扰动都愚弄。对抗性培训(AT)是一种近似解决了稳健的优化问题,以最大限度地减少最坏情况损失,并且被广泛认为是对这种攻击的最有效的防御。由于产生了强大的对抗性示例的高计算时间,已经提出了单步方法来减少培训时间。然而,这些方法遭受灾难性的过度装备,在训练期间侵犯准确度下降。虽然提出了改进,但它们增加了培训时间和稳健性远非多步骤。我们为FW优化(FW-AT)开发了对抗的对抗培训的理论框架,揭示了损失景观与$ \ ell_2 $失真之间的几何连接。我们分析地表明FW攻击的高变形相当于沿攻击路径的小梯度变化。然后在各种深度神经网络架构上进行实验证明,$ \ ell \ infty $攻击对抗强大的模型实现近乎最大的$ \ ell_2 $失真,而标准网络具有较低的失真。此外,实验表明,灾难性的过度拟合与FW攻击的低变形强烈相关。为了展示我们理论框架的效用,我们开发FW-AT-Adap,这是一种新的逆势训练算法,它使用简单的失真度量来调整攻击步骤的数量,以提高效率而不会影响鲁棒性。 FW-AT-Adapt提供培训时间以单步快速分配方法,并改善了在白色盒子和黑匣子设置中的普发内精度的最小损失和多步PGD之间的差距。
translated by 谷歌翻译
It is common practice in deep learning to use overparameterized networks and train for as long as possible; there are numerous studies that show, both theoretically and empirically, that such practices surprisingly do not unduly harm the generalization performance of the classifier. In this paper, we empirically study this phenomenon in the setting of adversarially trained deep networks, which are trained to minimize the loss under worst-case adversarial perturbations. We find that overfitting to the training set does in fact harm robust performance to a very large degree in adversarially robust training across multiple datasets (SVHN, CIFAR-10, CIFAR-100, and ImageNet) and perturbation models ( ∞ and 2 ). Based upon this observed effect, we show that the performance gains of virtually all recent algorithmic improvements upon adversarial training can be matched by simply using early stopping. We also show that effects such as the double descent curve do still occur in adversarially trained models, yet fail to explain the observed overfitting. Finally, we study several classical and modern deep learning remedies for overfitting, including regularization and data augmentation, and find that no approach in isolation improves significantly upon the gains achieved by early stopping. All code for reproducing the experiments as well as pretrained model weights and training logs can be found at https://github.com/ locuslab/robust_overfitting.
translated by 谷歌翻译
对抗性训练遭受了稳健的过度装备,这是一种现象,在训练期间鲁棒测试精度开始减少。在本文中,我们专注于通过使用常见的数据增强方案来减少强大的过度装备。我们证明,与先前的发现相反,当与模型重量平均结合时,数据增强可以显着提高鲁棒精度。此外,我们比较各种增强技术,并观察到空间组合技术适用于对抗性培训。最后,我们评估了我们在Cifar-10上的方法,而不是$ \ ell_ indty $和$ \ ell_2 $ norm-indeded扰动分别为尺寸$ \ epsilon = 8/255 $和$ \ epsilon = 128/255 $。与以前的最先进的方法相比,我们表现出+ 2.93%的绝对改善+ 2.93%,+ 2.16%。特别是,反对$ \ ell_ infty $ norm-indeded扰动尺寸$ \ epsilon = 8/255 $,我们的模型达到60.07%的强劲准确性而不使用任何外部数据。我们还通过这种方法实现了显着的性能提升,同时使用其他架构和数据集如CiFar-100,SVHN和TinyimageNet。
translated by 谷歌翻译
The study on improving the robustness of deep neural networks against adversarial examples grows rapidly in recent years. Among them, adversarial training is the most promising one, which flattens the input loss landscape (loss change with respect to input) via training on adversarially perturbed examples. However, how the widely used weight loss landscape (loss change with respect to weight) performs in adversarial training is rarely explored. In this paper, we investigate the weight loss landscape from a new perspective, and identify a clear correlation between the flatness of weight loss landscape and robust generalization gap. Several well-recognized adversarial training improvements, such as early stopping, designing new objective functions, or leveraging unlabeled data, all implicitly flatten the weight loss landscape. Based on these observations, we propose a simple yet effective Adversarial Weight Perturbation (AWP) to explicitly regularize the flatness of weight loss landscape, forming a double-perturbation mechanism in the adversarial training framework that adversarially perturbs both inputs and weights. Extensive experiments demonstrate that AWP indeed brings flatter weight loss landscape and can be easily incorporated into various existing adversarial training methods to further boost their adversarial robustness.
translated by 谷歌翻译
单步逆势培训(AT)受到了广泛的关注,因为它被证明是有效和健壮的。然而,存在严重的灾难性过度问题,即反对投影梯度下降(PGD)攻击的强劲准确性突然下降到培训期间的0.5美元。在本文中,我们从优化的新角度来看,首先揭示每个样品和过度装箱的快速增长梯度之间的密切联系,这也可以应用于了解多步骤中的稳健的过度拟合现象。为了控制培训期间梯度的增长,我们提出了一种新的方法,子空间对抗训练(子AT),限制了仔细提取的子空间。它成功地解决了两种过度装备,因此显着提高了鲁棒性。在子空间中,我们还允许单步合并较大的步骤和更大的半径,从而进一步提高了鲁棒性性能。因此,我们实现了最先进的单步性能:我们的纯单步可以达到超过$ \ mathbf {51} \%$鲁棒准确性,反对强大的PGD-50攻击以半径8美元/ CiFar-10上的255美元,甚至超过了标准的多步PGD-10,具有巨大的计算优势。代码已释放$ \脚注{\ url {https://github.com/nblt/sub -at}} $。
translated by 谷歌翻译
到目前为止对抗训练是抵御对抗例子的最有效的策略。然而,由于每个训练步骤中的迭代对抗性攻击,它遭受了高的计算成本。最近的研究表明,通过随机初始化执行单步攻击,可以实现快速的对抗训练。然而,这种方法仍然落后于稳定性和模型稳健性的最先进的对手训练算法。在这项工作中,我们通过观察随机平滑的随机初始化来更好地优化内部最大化问题,对快速对抗培训进行新的理解。在这种新的视角之后,我们还提出了一种新的初始化策略,向后平滑,进一步提高单步强大培训方法的稳定性和模型稳健性。多个基准测试的实验表明,我们的方法在使用更少的训练时间(使用相同的培训计划时,使用更少的培训时间($ \ sim $ 3x改进)时,我们的方法达到了类似的模型稳健性。
translated by 谷歌翻译
我们表明,当考虑到图像域$ [0,1] ^ D $时,已建立$ L_1 $ -Projected梯度下降(PGD)攻击是次优,因为它们不认为有效的威胁模型是交叉点$ l_1 $ -ball和$ [0,1] ^ d $。我们研究了这种有效威胁模型的最陡渐进步骤的预期稀疏性,并表明该组上的确切投影是计算可行的,并且产生更好的性能。此外,我们提出了一种自适应形式的PGD,即使具有小的迭代预算,这也是非常有效的。我们的结果$ l_1 $ -apgd是一个强大的白盒攻击,表明先前的作品高估了他们的$ l_1 $ -trobustness。使用$ l_1 $ -apgd for vercersarial培训,我们获得一个强大的分类器,具有sota $ l_1 $ -trobustness。最后,我们将$ l_1 $ -apgd和平方攻击的适应组合到$ l_1 $ to $ l_1 $ -autoattack,这是一个攻击的集合,可靠地评估$ l_1 $ -ball与$的威胁模型的对抗鲁棒性进行对抗[ 0,1] ^ d $。
translated by 谷歌翻译
Adversarial training is widely used to improve the robustness of deep neural networks to adversarial attack. However, adversarial training is prone to overfitting, and the cause is far from clear. This work sheds light on the mechanisms underlying overfitting through analyzing the loss landscape w.r.t. the input. We find that robust overfitting results from standard training, specifically the minimization of the clean loss, and can be mitigated by regularization of the loss gradients. Moreover, we find that robust overfitting turns severer during adversarial training partially because the gradient regularization effect of adversarial training becomes weaker due to the increase in the loss landscapes curvature. To improve robust generalization, we propose a new regularizer to smooth the loss landscape by penalizing the weighted logits variation along the adversarial direction. Our method significantly mitigates robust overfitting and achieves the highest robustness and efficiency compared to similar previous methods. Code is available at https://github.com/TreeLLi/Combating-RO-AdvLC.
translated by 谷歌翻译
快速对抗训练(脂肪)有效地提高了标准对抗训练(SAT)的效率。然而,初始脂肪遇到灾难性的过度拟合,即,对抗性攻击的稳健精度突然并大大减少。尽管有几种脂肪变体毫不费力地防止过度拟合,但他们牺牲了很多计算成本。在本文中,我们探讨了SAT和FAT的训练过程之间的差异,并观察到,对抗性实例(AES)脂肪的攻击成功率在后期训练阶段逐渐变得更糟,从而导致过度拟合。 AE是通过零或随机初始化的快速梯度标志方法(FGSM)生成的。根据观察结果,我们提出了一种先前的FGSM初始化方法,以避免在研究多种初始化策略后避免过度适应,从而在整个训练过程中提高了AE的质量。初始化是通过利用历史上生成的AE而没有额外计算成本而形成的。我们进一步为提出的初始化方法提供了理论分析。我们还基于先前的初始化,即当前生成的扰动不应过多地偏离先前引导的初始化,因此我们还提出了一个简单而有效的正规化程序。正常化器同时采用历史和当前的对抗性扰动来指导模型学习。在四个数据集上进行的评估表明,所提出的方法可以防止灾难性过度拟合和优于最先进的脂肪方法。该代码在https://github.com/jiaxiaojunqaq/fgsm-pgi上发布。
translated by 谷歌翻译
对共同腐败的稳健性的文献表明对逆势培训是否可以提高这种环境的性能,没有达成共识。 First, we show that, when used with an appropriately selected perturbation radius, $\ell_p$ adversarial training can serve as a strong baseline against common corruptions improving both accuracy and calibration.然后,我们解释了为什么对抗性训练比具有简单高斯噪声的数据增强更好地表现,这被观察到是对共同腐败的有意义的基线。与此相关,我们确定了高斯增强过度适用于用于培训的特定标准偏差的$ \ sigma $ -oviting现象,这对培训具有显着不利影响的普通腐败精度。我们讨论如何缓解这一问题,然后如何通过学习的感知图像贴片相似度引入对抗性训练的有效放松来进一步增强$ \ ell_p $普发的培训。通过对CiFar-10和Imagenet-100的实验,我们表明我们的方法不仅改善了$ \ ell_p $普发的培训基线,而且还有累积的收益与Augmix,Deepaulment,Ant和Sin等数据增强方法,导致普通腐败的最先进的表现。我们的实验代码在HTTPS://github.com/tml-epfl/adv-training - 窗子上公开使用。
translated by 谷歌翻译
对抗性的鲁棒性已经成为深度学习的核心目标,无论是在理论和实践中。然而,成功的方法来改善对抗的鲁棒性(如逆势训练)在不受干扰的数据上大大伤害了泛化性能。这可能会对对抗性鲁棒性如何影响现实世界系统的影响(即,如果它可以提高未受干扰的数据的准确性),许多人可能选择放弃鲁棒性)。我们提出内插对抗培训,该培训最近雇用了在对抗培训框架内基于插值的基于插值的培训方法。在CiFar -10上,对抗性训练增加了标准测试错误(当没有对手时)从4.43%到12.32%,而我们的内插对抗培训我们保留了对抗性的鲁棒性,同时实现了仅6.45%的标准测试误差。通过我们的技术,强大模型标准误差的相对增加从178.1%降至仅为45.5%。此外,我们提供内插对抗性培训的数学分析,以确认其效率,并在鲁棒性和泛化方面展示其优势。
translated by 谷歌翻译
Adversarial training, in which a network is trained on adversarial examples, is one of the few defenses against adversarial attacks that withstands strong attacks. Unfortunately, the high cost of generating strong adversarial examples makes standard adversarial training impractical on large-scale problems like ImageNet. We present an algorithm that eliminates the overhead cost of generating adversarial examples by recycling the gradient information computed when updating model parameters.Our "free" adversarial training algorithm achieves comparable robustness to PGD adversarial training on the CIFAR-10 and CIFAR-100 datasets at negligible additional cost compared to natural training, and can be 7 to 30 times faster than other strong adversarial training methods. Using a single workstation with 4 P100 GPUs and 2 days of runtime, we can train a robust model for the large-scale ImageNet classification task that maintains 40% accuracy against PGD attacks. The code is available at https://github.com/ashafahi/free_adv_train.
translated by 谷歌翻译
现代神经网络Excel在图像分类中,但它们仍然容易受到常见图像损坏,如模糊,斑点噪音或雾。最近的方法关注这个问题,例如Augmix和Deepaulment,引入了在预期运行的防御,以期望图像损坏分布。相比之下,$ \ ell_p $ -norm界限扰动的文献侧重于针对最坏情况损坏的防御。在这项工作中,我们通过提出防范内人来调和两种方法,这是一种优化图像到图像模型的参数来产生对外损坏的增强图像的技术。我们理论上激发了我们的方法,并为其理想化版本的一致性以及大纲领提供了足够的条件。我们的分类机器在预期对CiFar-10-C进行的常见图像腐败基准上提高了最先进的,并改善了CIFAR-10和ImageNet上的$ \ ell_p $ -norm有界扰动的最坏情况性能。
translated by 谷歌翻译
Recent work has demonstrated that deep neural networks are vulnerable to adversarial examples-inputs that are almost indistinguishable from natural data and yet classified incorrectly by the network. In fact, some of the latest findings suggest that the existence of adversarial attacks may be an inherent weakness of deep learning models. To address this problem, we study the adversarial robustness of neural networks through the lens of robust optimization. This approach provides us with a broad and unifying view on much of the prior work on this topic. Its principled nature also enables us to identify methods for both training and attacking neural networks that are reliable and, in a certain sense, universal. In particular, they specify a concrete security guarantee that would protect against any adversary. These methods let us train networks with significantly improved resistance to a wide range of adversarial attacks. They also suggest the notion of security against a first-order adversary as a natural and broad security guarantee. We believe that robustness against such well-defined classes of adversaries is an important stepping stone towards fully resistant deep learning models. 1
translated by 谷歌翻译
通过快速梯度符号方法(FGSM)生成的样品(也称为FGSM-AT)生成的样品是一种计算上的简单方法,可以训练训练强大的网络。然而,在训练过程中,在Arxiv:2001.03994 [CS.LG]中发现了一种不稳定的“灾难性过度拟合”模式,在单个训练步骤中,强大的精度突然下降到零。现有方法使用梯度正规化器或随机初始化技巧来减轻此问题,而它们要么承担高计算成本或导致较低的稳健精度。在这项工作中,我们提供了第一项研究,该研究从三个角度彻底研究了技巧的集合:数据初始化,网络结构和优化,以克服FGSM-AT中的灾难性过度拟合。令人惊讶的是,我们发现简单的技巧,即a)掩盖部分像素(即使没有随机性),b)设置较大的卷积步幅和平滑的激活功能,或c)正规化第一卷积层的重量,可以有效地应对过度拟合问题。对一系列网络体系结构的广泛结果验证了每个提出的技巧的有效性,还研究了技巧的组合。例如,在CIFAR-10上接受了PREACTRESNET-18培训,我们的方法对PGD-50攻击者的准确性为49.8%,并且针对AutoAttack的精度为46.4%,这表明Pure FGSM-AT能够启用健壮的学习者。代码和模型可在https://github.com/ucsc-vlaa/bag-of-tricks-for-for-fgsm-at上公开获得。
translated by 谷歌翻译
尽管对抗性和自然训练(AT和NT)之间有基本的区别,但在方法中,通常采用动量SGD(MSGD)进行外部优化。本文旨在通过研究AT中外部优化的忽视作用来分析此选择。我们的探索性评估表明,与NT相比,在诱导较高的梯度规范和方差。由于MSGD的收敛速率高度取决于梯度的方差,因此这种现象阻碍了AT的外部优化。为此,我们提出了一种称为ENGM的优化方法,该方法将每个输入示例对平均微型批次梯度的贡献进行正规化。我们证明ENGM的收敛速率与梯度的方差无关,因此适合AT。我们介绍了一种技巧,可以使用有关梯度范围W.R.T.规范的相关性的经验观察来降低ENGM的计算成本。网络参数和输入示例。我们对CIFAR-10,CIFAR-100和Tinyimagenet的广泛评估和消融研究表明,Engm及其变体一致地改善了广泛的AT方法的性能。此外,Engm减轻了AT的主要缺点,包括强大的过度拟合和对超参数设置的敏感性。
translated by 谷歌翻译