对抗性培训（AT）已成为培训强大网络的热门选择。然而，它倾向于牺牲清洁精度，以令人满意的鲁棒性，并且遭受大的概括误差。为了解决这些问题，我们提出了平稳的对抗培训（SAT），以我们对损失令人歉端的损失的终人谱指导。 We find that curriculum learning, a scheme that emphasizes on starting "easy" and gradually ramping up on the "difficulty" of training, smooths the adversarial loss landscape for a suitably chosen difficulty metric.我们展示了对普通环境中的课程学习的一般制定，并提出了一种基于最大Hessian特征值（H-SAT）和软MAX概率（P-SA）的两个难度指标。我们展示SAT稳定网络培训即使是大型扰动规范，并且允许网络以更好的清洁精度运行而与鲁棒性权衡曲线相比。与AT，交易和其他基线相比，这导致清洁精度和鲁棒性的显着改善。为了突出一些结果，我们的最佳模型将分别在CIFAR-100上提高6％和1％的稳健准确性。在Imagenette上，一个十一级想象成的子集，我们的模型分别以正常和强大的准确性达到23％和3％。

到目前为止对抗训练是抵御对抗例子的最有效的策略。然而，由于每个训练步骤中的迭代对抗性攻击，它遭受了高的计算成本。最近的研究表明，通过随机初始化执行单步攻击，可以实现快速的对抗训练。然而，这种方法仍然落后于稳定性和模型稳健性的最先进的对手训练算法。在这项工作中，我们通过观察随机平滑的随机初始化来更好地优化内部最大化问题，对快速对抗培训进行新的理解。在这种新的视角之后，我们还提出了一种新的初始化策略，向后平滑，进一步提高单步强大培训方法的稳定性和模型稳健性。多个基准测试的实验表明，我们的方法在使用更少的训练时间（使用相同的培训计划时，使用更少的培训时间（$ \ sim $ 3x改进）时，我们的方法达到了类似的模型稳健性。

对抗性培训（AT）已成为一种广泛认可的防御机制，以提高深度神经网络对抗对抗攻击的鲁棒性。它解决了最小的最大优化问题，其中最小化器（即，后卫）寻求稳健的模型，以最小化由最大化器（即，攻击者）制成的对抗示例存在的最坏情况训练损失。然而，Min-Max的性质在计算密集并因此难以扩展。同时，快速算法，实际上，许多最近改进的算法，通过替换基于简单的单次梯度标志的攻击生成步骤来简化基于最大化步骤的最小值。虽然易于实施，快速缺乏理论保证，其实际表现可能是不令人满意的，患有强大的对手训练时的鲁棒性灾难性过度。在本文中，我们从双级优化（BLO）的角度来看，旨在快速设计。首先，首先进行关键观察，即快速at的最常用的算法规范等同于使用一些梯度下降型算法来解决涉及符号操作的双级问题。然而，标志操作的离散性使得难以理解算法的性能。基于上述观察，我们提出了一种新的遗传性双层优化问题，设计和分析了一组新的算法（快速蝙蝠）。 FAST-BAT能够捍卫基于符号的投影梯度下降（PGD）攻击，而无需调用任何渐变标志方法和明确的鲁棒正则化。此外，我们经验证明，通过在不诱导鲁棒性灾难性过度的情况下实现卓越的模型稳健性，或患有任何标准精度损失的稳健性，我们的方法优于最先进的快速基线。

Adversarial training is widely used to improve the robustness of deep neural networks to adversarial attack. However, adversarial training is prone to overfitting, and the cause is far from clear. This work sheds light on the mechanisms underlying overfitting through analyzing the loss landscape w.r.t. the input. We find that robust overfitting results from standard training, specifically the minimization of the clean loss, and can be mitigated by regularization of the loss gradients. Moreover, we find that robust overfitting turns severer during adversarial training partially because the gradient regularization effect of adversarial training becomes weaker due to the increase in the loss landscapes curvature. To improve robust generalization, we propose a new regularizer to smooth the loss landscape by penalizing the weighted logits variation along the adversarial direction. Our method significantly mitigates robust overfitting and achieves the highest robustness and efficiency compared to similar previous methods. Code is available at https://github.com/TreeLLi/Combating-RO-AdvLC.

Adaptive attacks have (rightfully) become the de facto standard for evaluating defenses to adversarial examples. We find, however, that typical adaptive evaluations are incomplete. We demonstrate that thirteen defenses recently published at ICLR, ICML and NeurIPS-and which illustrate a diverse set of defense strategies-can be circumvented despite attempting to perform evaluations using adaptive attacks. While prior evaluation papers focused mainly on the end result-showing that a defense was ineffective-this paper focuses on laying out the methodology and the approach necessary to perform an adaptive attack. Some of our attack strategies are generalizable, but no single strategy would have been sufficient for all defenses. This underlines our key message that adaptive attacks cannot be automated and always require careful and appropriate tuning to a given defense. We hope that these analyses will serve as guidance on how to properly perform adaptive attacks against defenses to adversarial examples, and thus will allow the community to make further progress in building more robust models.

神经网络对攻击的缺乏鲁棒性引起了对安全敏感环境（例如自动驾驶汽车）的担忧。虽然许多对策看起来可能很有希望，但只有少数能够承受严格的评估。使用随机变换（RT）的防御能力显示出令人印象深刻的结果，尤其是Imagenet上的Bart（Raff等，2019）。但是，这种防御尚未经过严格评估，使其稳健性的理解不足。它们的随机特性使评估更具挑战性，并使对确定性模型的许多拟议攻击不可应用。首先，我们表明BART评估中使用的BPDA攻击（Athalye等，2018a）无效，可能高估了其稳健性。然后，我们尝试通过明智的转换和贝叶斯优化来调整其参数来构建最强的RT防御。此外，我们创造了最强烈的攻击来评估我们的RT防御。我们的新攻击极大地胜过基线，与常用的EOT攻击减少19％相比，将准确性降低了83％（$ 4.3 \ times $改善）。我们的结果表明，在Imagenette数据集上的RT防御（ImageNet的十级子集）在对抗性示例上并不强大。进一步扩展研究，我们使用新的攻击来对抗RT防御（称为Advrt），从而获得了巨大的稳健性增长。代码可从https://github.com/wagner-group/demystify-random-transform获得。

随机平滑是目前是最先进的方法，用于构建来自Neural Networks的可认真稳健的分类器，以防止$ \ ell_2 $ - vitersarial扰动。在范例下，分类器的稳健性与预测置信度对齐，即，对平滑分类器的较高的置信性意味着更好的鲁棒性。这使我们能够在校准平滑分类器的信仰方面重新思考准确性和鲁棒性之间的基本权衡。在本文中，我们提出了一种简单的训练方案，Coined Spiremix，通过自我混合来控制平滑分类器的鲁棒性：它沿着每个输入对逆势扰动方向进行样品的凸起组合。该提出的程序有效地识别过度自信，在平滑分类器的情况下，作为有限的稳健性的原因，并提供了一种直观的方法来自适应地在这些样本之间设置新的决策边界，以实现更好的鲁棒性。我们的实验结果表明，与现有的最先进的强大培训方法相比，该方法可以显着提高平滑分类器的认证$ \ ell_2 $ -toSpustness。

对抗性的鲁棒性已成为机器学习越来越兴趣的话题，因为观察到神经网络往往会变得脆弱。我们提出了对逆转防御的信息几何表述，并引入Fire，这是一种针对分类跨透明镜损失的新的Fisher-Rao正则化，这基于对应于自然和受扰动输入特征的软磁输出之间的测量距离。基于SoftMax分布类的信息几何特性，我们为二进制和多类案例提供了Fisher-Rao距离（FRD）的明确表征，并绘制了一些有趣的属性以及与标准正则化指标的连接。此外，对于一个简单的线性和高斯模型，我们表明，在精度 - 舒适性区域中的所有帕累托最佳点都可以通过火力达到，而其他最先进的方法则可以通过火灾。从经验上讲，我们评估了经过标准数据集拟议损失的各种分类器的性能，在清洁和健壮的表现方面同时提高了1 \％的改进，同时将培训时间降低了20 \％，而不是表现最好的方法。

尽管深层神经网络在各种任务中取得了巨大的成功，但它们对不可察觉的对抗性扰动的脆弱性阻碍了他们在现实世界中的部署。最近，与随机合奏的作品相对于经过最小的计算开销的标准对手训练（AT）模型，对对抗性训练（AT）模型的对抗性鲁棒性有了显着改善，这使它们成为安全临界资源限制应用程序的有前途解决方案。但是，这种令人印象深刻的表现提出了一个问题：这些稳健性是由随机合奏提供的吗？在这项工作中，我们从理论和经验上都解决了这个问题。从理论上讲，我们首先确定通常采用的鲁棒性评估方法（例如自适应PGD）在这种情况下提供了错误的安全感。随后，我们提出了一种理论上有效的对抗攻击算法（ARC），即使在自适应PGD无法做到这一点的情况下，也能妥协随机合奏。我们在各种网络体系结构，培训方案，数据集和规范上进行全面的实验，以支持我们的主张，并经验证明，随机合奏实际上比在模型上更容易受到$ \ ell_p $结合的对抗性扰动的影响。我们的代码可以在https://github.com/hsndbk4/arc上找到。

Recent work has demonstrated that deep neural networks are vulnerable to adversarial examples-inputs that are almost indistinguishable from natural data and yet classified incorrectly by the network. In fact, some of the latest findings suggest that the existence of adversarial attacks may be an inherent weakness of deep learning models. To address this problem, we study the adversarial robustness of neural networks through the lens of robust optimization. This approach provides us with a broad and unifying view on much of the prior work on this topic. Its principled nature also enables us to identify methods for both training and attacking neural networks that are reliable and, in a certain sense, universal. In particular, they specify a concrete security guarantee that would protect against any adversary. These methods let us train networks with significantly improved resistance to a wide range of adversarial attacks. They also suggest the notion of security against a first-order adversary as a natural and broad security guarantee. We believe that robustness against such well-defined classes of adversaries is an important stepping stone towards fully resistant deep learning models. 1

State-of-the-art classifiers have been shown to be largely vulnerable to adversarial perturbations. One of the most effective strategies to improve robustness is adversarial training. In this paper, we investigate the effect of adversarial training on the geometry of the classification landscape and decision boundaries. We show in particular that adversarial training leads to a significant decrease in the curvature of the loss surface with respect to inputs, leading to a drastically more "linear" behaviour of the network. Using a locally quadratic approximation, we provide theoretical evidence on the existence of a strong relation between large robustness and small curvature. To further show the importance of reduced curvature for improving the robustness, we propose a new regularizer that directly minimizes curvature of the loss surface, and leads to adversarial robustness that is on par with adversarial training. Besides being a more efficient and principled alternative to adversarial training, the proposed regularizer confirms our claims on the importance of exhibiting quasi-linear behavior in the vicinity of data points in order to achieve robustness.

The evaluation of robustness against adversarial manipulation of neural networks-based classifiers is mainly tested with empirical attacks as methods for the exact computation, even when available, do not scale to large networks. We propose in this paper a new white-box adversarial attack wrt the l p -norms for p ∈ {1, 2, ∞} aiming at finding the minimal perturbation necessary to change the class of a given input. It has an intuitive geometric meaning, yields quickly high quality results, minimizes the size of the perturbation (so that it returns the robust accuracy at every threshold with a single run). It performs better or similar to stateof-the-art attacks which are partially specialized to one l p -norm, and is robust to the phenomenon of gradient masking.

与标准的训练时间相比，训练时间非常长，尤其是针对稳健模型的主要缺点，尤其是对于大型数据集而言。此外，模型不仅应适用于一个$ l_p $ - 威胁模型，而且对所有模型来说都是理想的。在本文中，我们提出了基于$ l_p $ -Balls的几何特性的多元素鲁棒性的极端规范对抗训练（E-AT）。 E-AT的成本比其他对抗性训练方法低三倍，以进行多种锻炼。使用e-at，我们证明，对于ImageNet，单个时期和CIFAR-10，三个时期足以将任何$ L_P $ - 抛光模型变成一个多符号鲁棒模型。通过这种方式，我们获得了ImageNet的第一个多元素鲁棒模型，并在CIFAR-10上提高了多个Norm鲁棒性的最新型号，以超过$ 51 \％$。最后，我们通过对不同单独的$ l_p $ threat模型之间的对抗鲁棒性进行微调研究一般的转移，并改善了Cifar-10和Imagenet上的先前的SOTA $ L_1 $ - 固定。广泛的实验表明，我们的计划在包括视觉变压器在内的数据集和架构上起作用。

现有针对对抗性示例（例如对抗训练）的防御能力通常假设对手将符合特定或已知的威胁模型，例如固定预算内的$ \ ell_p $扰动。在本文中，我们关注的是在训练过程中辩方假设的威胁模型中存在不匹配的情况，以及在测试时对手的实际功能。我们问一个问题：学习者是否会针对特定的“源”威胁模型进行训练，我们什么时候可以期望鲁棒性在测试时间期间概括为更强大的未知“目标”威胁模型？我们的主要贡献是通过不可预见的对手正式定义学习和概括的问题，这有助于我们从常规的对手的传统角度来理解对抗风险的增加。应用我们的框架，我们得出了将源和目标威胁模型之间的概括差距与特征提取器变化相关联的概括，该限制衡量了在给定威胁模型中提取的特征之间的预期最大差异。基于我们的概括结合，我们提出了具有变化正则化（AT-VR）的对抗训练，该训练在训练过程中降低了特征提取器在源威胁模型中的变化。我们从经验上证明，与标准的对抗训练相比，AT-VR可以改善测试时间内的概括，从而无法预见。此外，我们将变异正则化与感知对抗训练相结合[Laidlaw等。 2021]以实现不可预见的攻击的最新鲁棒性。我们的代码可在https://github.com/inspire-group/variation-regularization上公开获取。

深度神经网络很容易被称为对抗攻击的小扰动都愚弄。对抗性培训（AT）是一种近似解决了稳健的优化问题，以最大限度地减少最坏情况损失，并且被广泛认为是对这种攻击的最有效的防御。由于产生了强大的对抗性示例的高计算时间，已经提出了单步方法来减少培训时间。然而，这些方法遭受灾难性的过度装备，在训练期间侵犯准确度下降。虽然提出了改进，但它们增加了培训时间和稳健性远非多步骤。我们为FW优化（FW-AT）开发了对抗的对抗培训的理论框架，揭示了损失景观与$ \ ell_2 $失真之间的几何连接。我们分析地表明FW攻击的高变形相当于沿攻击路径的小梯度变化。然后在各种深度神经网络架构上进行实验证明，$ \ ell \ infty $攻击对抗强大的模型实现近乎最大的$ \ ell_2 $失真，而标准网络具有较低的失真。此外，实验表明，灾难性的过度拟合与FW攻击的低变形强烈相关。为了展示我们理论框架的效用，我们开发FW-AT-Adap，这是一种新的逆势训练算法，它使用简单的失真度量来调整攻击步骤的数量，以提高效率而不会影响鲁棒性。 FW-AT-Adapt提供培训时间以单步快速分配方法，并改善了在白色盒子和黑匣子设置中的普发内精度的最小损失和多步PGD之间的差距。

最近，张等人。（2021）基于$ \ ell_ \ infty $ -distance函数开发出一种新的神经网络架构，自然拥有经过认证的$ \ ell_ \ infty $坚固的稳健性。尽管具有出色的理论特性，但到目前为止的模型只能实现与传统网络的可比性。在本文中，我们通过仔细分析培训流程，大大提高了$ \ ell_ \ infty $ -distance网的认证稳健性。特别是，我们展示了$ \ ell_p $ -rexation，这是克服模型的非平滑度的关键方法，导致早期训练阶段的意外的大型嘴唇浓度。这使得优化不足以使用铰链损耗并产生次优溶液。鉴于这些调查结果，我们提出了一种简单的方法来解决上述问题，设计一种新的客观函数，这些功能将缩放的跨熵损失结合在剪切铰链损失。实验表明，使用拟议的培训策略，$ \ ell_ \ infty $-distance网的认证准确性可以从Cifar-10（$ \ epsilon = 8/255 $）的33.30％到40.06％的显着提高到40.06％，同时显着优于表现优势该地区的其他方法。我们的结果清楚地展示了$ \ ell_ \ infty $-distance净的有效性和潜力，以获得认证的稳健性。代码在https://github.com/zbh2047/l_inf-dist-net-v2上获得。

In today's heavily overparameterized models, the value of the training loss provides few guarantees on model generalization ability. Indeed, optimizing only the training loss value, as is commonly done, can easily lead to suboptimal model quality. Motivated by prior work connecting the geometry of the loss landscape and generalization, we introduce a novel, effective procedure for instead simultaneously minimizing loss value and loss sharpness. In particular, our procedure, Sharpness-Aware Minimization (SAM), seeks parameters that lie in neighborhoods having uniformly low loss; this formulation results in a minmax optimization problem on which gradient descent can be performed efficiently. We present empirical results showing that SAM improves model generalization across a variety of benchmark datasets (e.g., CIFAR-{10, 100}, Ima-geNet, finetuning tasks) and models, yielding novel state-of-the-art performance for several. Additionally, we find that SAM natively provides robustness to label noise on par with that provided by state-of-the-art procedures that specifically target learning with noisy labels. We open source our code at https: //github.com/google-research/sam. * Work done as part of the Google AI Residency program.

It is common practice in deep learning to use overparameterized networks and train for as long as possible; there are numerous studies that show, both theoretically and empirically, that such practices surprisingly do not unduly harm the generalization performance of the classifier. In this paper, we empirically study this phenomenon in the setting of adversarially trained deep networks, which are trained to minimize the loss under worst-case adversarial perturbations. We find that overfitting to the training set does in fact harm robust performance to a very large degree in adversarially robust training across multiple datasets (SVHN, CIFAR-10, CIFAR-100, and ImageNet) and perturbation models ( ∞ and 2 ). Based upon this observed effect, we show that the performance gains of virtually all recent algorithmic improvements upon adversarial training can be matched by simply using early stopping. We also show that effects such as the double descent curve do still occur in adversarially trained models, yet fail to explain the observed overfitting. Finally, we study several classical and modern deep learning remedies for overfitting, including regularization and data augmentation, and find that no approach in isolation improves significantly upon the gains achieved by early stopping. All code for reproducing the experiments as well as pretrained model weights and training logs can be found at https://github.com/ locuslab/robust_overfitting.

Adversarial training, in which a network is trained on adversarial examples, is one of the few defenses against adversarial attacks that withstands strong attacks. Unfortunately, the high cost of generating strong adversarial examples makes standard adversarial training impractical on large-scale problems like ImageNet. We present an algorithm that eliminates the overhead cost of generating adversarial examples by recycling the gradient information computed when updating model parameters.Our "free" adversarial training algorithm achieves comparable robustness to PGD adversarial training on the CIFAR-10 and CIFAR-100 datasets at negligible additional cost compared to natural training, and can be 7 to 30 times faster than other strong adversarial training methods. Using a single workstation with 4 P100 GPUs and 2 days of runtime, we can train a robust model for the large-scale ImageNet classification task that maintains 40% accuracy against PGD attacks. The code is available at https://github.com/ashafahi/free_adv_train.

Adversarial training, a method for learning robust deep networks, is typically assumed to be more expensive than traditional training due to the necessity of constructing adversarial examples via a first-order method like projected gradient decent (PGD). In this paper, we make the surprising discovery that it is possible to train empirically robust models using a much weaker and cheaper adversary, an approach that was previously believed to be ineffective, rendering the method no more costly than standard training in practice. Specifically, we show that adversarial training with the fast gradient sign method (FGSM), when combined with random initialization, is as effective as PGD-based training but has significantly lower cost. Furthermore we show that FGSM adversarial training can be further accelerated by using standard techniques for efficient training of deep networks, allowing us to learn a robust CIFAR10 classifier with 45% robust accuracy to PGD attacks with = 8/255 in 6 minutes, and a robust ImageNet classifier with 43% robust accuracy at = 2/255 in 12 hours, in comparison to past work based on "free" adversarial training which took 10 and 50 hours to reach the same respective thresholds. Finally, we identify a failure mode referred to as "catastrophic overfitting" which may have caused previous attempts to use FGSM adversarial training to fail. All code for reproducing the experiments in this paper as well as pretrained model weights are at https://github.com/locuslab/fast_adversarial.