{"type":"ScholarlyArticle","title":"Robust Weight Perturbation for Adversarial Training","authors":[{"name":"Chaojian Yu","slug":"chaojian-yu","given":"Chaojian","family":"Yu","affiliation":"Trustworthy Machine Learning Lab , School of Computer Science , The University of Sydney , Australia"},{"name":"Bo Han","slug":"bo-han","given":"Bo","family":"Han","affiliation":"Department of Computer Science , Hong Kong Baptist University , China"},{"name":"Mingming Gong","slug":"mingming-gong","given":"Mingming","family":"Gong","affiliation":"School of Mathematics and Statistics , The University of Melbourne , Australia"},{"name":"Li Shen","slug":"li-shen","given":"Li","family":"Shen","affiliation":"JD Explore Academy , China"},{"name":"Shiming Ge","slug":"shiming-ge","given":"Shiming","family":"Ge","affiliation":"Institute of Information Engineering , Chinese Academy of Sciences , China"},{"name":"Du Bo","slug":"du-bo","given":"Du","family":"Bo","affiliation":"School of Computer Science , Wuhan University , China"},{"name":"Tongliang Liu","slug":"tongliang-liu","given":"Tongliang","family":"Liu","affiliation":"Trustworthy Machine Learning Lab , School of Computer Science , The University of Sydney , Australia"}],"abstract":"Overfitting widely exists in adversarial robust training of deep networks. An effective remedy is adversarial weight perturbation, which injects the worst-case weight perturbation during network training by maximizing the classification loss on adversarial examples. Adversarial weight perturbation helps reduce the robust generalization gap; however, it also undermines the robustness improvement. A criterion that regulates the weight perturbation is therefore crucial for adversarial training. In this paper, we propose such a criterion, namely Loss Stationary Condition (LSC) for constrained perturbation. With LSC, we find that it is essential to conduct weight perturbation on adversarial data with small classification loss to eliminate robust overfitting. Weight perturbation on adversarial data with large classification loss is not necessary and may even lead to poor robustness. Based on these observations, we propose a robust perturbation strategy to constrain the extent of weight perturbation. The perturbation strategy prevents deep networks from overfitting while avoiding the side effect of excessive weight perturbation,  significantly improving the robustness of adversarial training. Extensive experiments demonstrate the superiority of the proposed method over the state-of-the-art adversarial training methods.","doi":"10.24963/ijcai.2022/512","url":"https://ijcai.org/proceedings/2022/512","pdf":"https://ijcai.org/proceedings/2022/0512.pdf","markdown":"https://ijcai.org/proceedings/2022/512.md","bibtex":"https://ijcai.org/proceedings/2022/bibtex/512","volume":{"slug":"2022","title":"Proceedings of the Thirty-First International Joint Conference on Artificial Intelligence","short_title":"IJCAI 2022","url":"https://ijcai.org/proceedings/2022/","year":2022,"location":"Vienna","dates":"23-29 July 2022","editors":"Luc De Raedt","isbn":"978-1-956792-00-3","publisher":"International Joint Conferences on Artificial Intelligence Organization","doi_prefix":"10.24963/ijcai.2022"},"section":"Machine Learning","track":"Main Track","number":512,"pages":{"first":3688,"last":3694},"keywords":["Machine Learning: Adversarial Machine Learning"],"videos":[{"label":"Video #1","url":"https://slideslive.com/38986548","length_sec":75,"provider":"slideslive"},{"label":"Video #2","url":"https://slideslive.com/38984691","length_sec":294,"provider":"slideslive"}],"references":[{"position":1,"raw":"[Athalye et al., 2018] Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. In International conference on machine learning, pages 274-283. PMLR, 2018.","title":"Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples","authors":"Anish Athalye, Nicholas Carlini, David Wagner","year":"2018","venue":"International conference on machine learning","doi":null,"url":null,"internal_url":null},{"position":2,"raw":"[Belkin et al., 2019] Mikhail Belkin, Daniel Hsu, Siyuan Ma, and Soumik Mandal. Reconciling modern machine- learning practice and the classical bias-variance trade- off. Proceedings of the National Academy of Sciences, 116(32):15849-15854, 2019.","title":"Reconciling modern machinelearning practice and the classical bias-variance tradeoff","authors":"Mikhail Belkin, Daniel Hsu, Siyuan Ma, Soumik Mandal","year":"2019","venue":"Proceedings of the National Academy of Sciences","doi":null,"url":null,"internal_url":null},{"position":3,"raw":"[Carmon et al., 2019] Yair Carmon, Aditi Raghunathan, Ludwig Schmidt, Percy Liang, and John C Duchi. Unla- beled data improves adversarial robustness. arXiv preprint arXiv:1905.13736, 2019.","title":"Unlabeled data improves adversarial robustness","authors":"Yair Carmon, Aditi Raghunathan, Ludwig Schmidt, Percy Liang, John C Duchi","year":"2019","venue":null,"doi":null,"url":null,"internal_url":null},{"position":4,"raw":"[Chen et al., 2020] Tianlong Chen, Zhenyu Zhang, Sijia Liu, Shiyu Chang, and Zhangyang Wang. Robust overfit- ting may be mitigated by properly learned smoothening. In International Conference on Learning Representations, 2020.","title":"Robust overfitting may be mitigated by properly learned smoothening","authors":"Tianlong Chen, Zhenyu Zhang, Sijia Liu, Shiyu Chang, Zhangyang Wang","year":"2020","venue":"International Conference on Learning Representations","doi":null,"url":null,"internal_url":null},{"position":5,"raw":"[Chen et al., 2021] Chen Chen, Jingfeng Zhang, Xilie Xu, Tianlei Hu, Gang Niu, Gang Chen, and Masashi Sugiyama. Guided interpolation for adversarial training. arXiv preprint arXiv:2102.07327, 2021.","title":"Guided interpolation for adversarial training","authors":"Chen Chen, Jingfeng Zhang, Xilie Xu, Tianlei Hu, Gang Niu, Gang Chen, Masashi Sugiyama","year":"2021","venue":null,"doi":null,"url":null,"internal_url":null},{"position":6,"raw":"[Croce and Hein, 2020] Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an en- semble of diverse parameter-free attacks. In Interna- tional conference on machine learning, pages 2206-2216.","title":"Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks","authors":"Croce, Hein, Francesco Croce, Matthias Hein","year":"2020","venue":"International conference on machine learning","doi":null,"url":null,"internal_url":null},{"position":7,"raw":"PMLR, 2020.","title":null,"authors":"Pmlr","year":"2020","venue":null,"doi":null,"url":null,"internal_url":null},{"position":8,"raw":"[Devlin et al., 2018] Jacob Devlin, Ming-Wei Chang, Ken- ton Lee, and Kristina Toutanova. Bert: Pre-training of deep bidirectional transformers for language understand- ing. arXiv preprint arXiv:1810.04805, 2018.","title":"Bert: Pre-training of deep bidirectional transformers for language understanding","authors":"Jacob Devlin, Ming-Wei Chang, Kenton Lee, Kristina Toutanova","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":9,"raw":"[Goodfellow et al., 2014] Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572, 2014.","title":"Explaining and harnessing adversarial examples","authors":"Ian J Goodfellow, Jonathon Shlens, Christian Szegedy","year":"2014","venue":null,"doi":null,"url":null,"internal_url":null},{"position":10,"raw":"[He et al., 2016] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 770-778, 2016.","title":"Deep residual learning for image recognition","authors":"Kaiming He, Xiangyu Zhang, Shaoqing Ren, Jian Sun","year":"2016","venue":"Proceedings of the IEEE conference on computer vision and pattern recognition","doi":null,"url":null,"internal_url":null},{"position":11,"raw":"[Lee et al., 2020] Saehyung Lee, Hyungyu Lee, and Sun- groh Yoon. Adversarial vertex mixup: Toward better ad- versarially robust generalization. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 272-281, 2020.","title":"and Sungroh Yoon. Adversarial vertex mixup: Toward better adversarially robust generalization","authors":"Lee","year":"2020","venue":"Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition","doi":null,"url":null,"internal_url":null},{"position":12,"raw":"[Madry et al., 2017] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083, 2017.","title":"Towards deep learning models resistant to adversarial attacks","authors":"Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, Adrian Vladu","year":"2017","venue":null,"doi":null,"url":null,"internal_url":null},{"position":13,"raw":"[Rice et al., 2020] Leslie Rice, Eric Wong, and Zico Kolter. Overfitting in adversarially robust deep learning. In Inter- national Conference on Machine Learning, pages 8093- 8104. PMLR, 2020. Schmidt et al., 2018] Ludwig Schmidt, Shibani Santurkar, Dimitris Tsipras, Kunal Talwar, and Aleksander Madry. Adversarially robust generalization requires more data. Advances in Neural Information Processing Systems, 31:5014-5026, 2018.","title":"Adversarially robust generalization requires more data","authors":"Leslie Rice, Eric Wong, Zico Kolter, ; Schmidt","year":"2018","venue":"Advances in Neural Information Processing Systems","doi":null,"url":null,"internal_url":null},{"position":14,"raw":"[Song et al., 2020] Chubiao Song, Kun He, Jiadong Lin, Li- wei Wang, and John E Hopcroft. Robust local features for improving the generalization of adversarial training. In International Conference on Learning Representations, 2020.","title":"Robust local features for improving the generalization of adversarial training","authors":"Song","year":"2020","venue":"International Conference on Learning Representations","doi":null,"url":null,"internal_url":null},{"position":15,"raw":"[Szegedy et al., 2013] Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199, 2013.","title":"Intriguing properties of neural networks","authors":"Szegedy","year":"2013","venue":null,"doi":null,"url":null,"internal_url":null},{"position":16,"raw":"[Uesato et al., 2019] Jonathan Uesato, Jean-Baptiste Alayrac, Po-Sen Huang, Robert Stanforth, Alhussein Fawzi, and Pushmeet Kohli. Are labels required for improving adversarial robustness? arXiv preprint arXiv:1905.13725, 2019.","title":"Are labels required for improving adversarial robustness","authors":"Jonathan Uesato, Jean-Baptiste Alayrac, Po-Sen Huang, Robert Stanforth, Alhussein Fawzi, Pushmeet Kohli","year":"2019","venue":null,"doi":null,"url":null,"internal_url":null},{"position":17,"raw":"[Wang et al., 2017] Yisen Wang, Xuejiao Deng, Songbai Pu, and Zhiheng Huang. Residual convolutional ctc net- works for automatic speech recognition. arXiv preprint arXiv:1702.07793, 2017.","title":"Residual convolutional ctc networks for automatic speech recognition","authors":"Wang","year":"2017","venue":null,"doi":null,"url":null,"internal_url":null},{"position":18,"raw":"[Wu et al., 2020] Dongxian Wu, Shu-Tao Xia, and Yisen Wang. Adversarial weight perturbation helps robust gen- eralization. Advances in Neural Information Processing Systems, 33, 2020.","title":"Adversarial weight perturbation helps robust generalization","authors":"Wu","year":"2020","venue":"Advances in Neural Information Processing Systems","doi":null,"url":null,"internal_url":null},{"position":19,"raw":"[Wu et al., 2021] Boxi Wu, Heng Pan, Li Shen, Jindong Gu, Shuai Zhao, Zhifeng Li, Deng Cai, Xiaofei He, and Wei Liu. Attacking adversarial attacks as a defense. arXiv preprint arXiv:2106.04938, 2021.","title":"Attacking adversarial attacks as a defense","authors":"Boxi Wu, Heng Pan, Li Shen, Jindong Gu, Shuai Zhao, Zhifeng Li, Deng Cai, Xiaofei He, Wei Liu","year":"2021","venue":null,"doi":null,"url":null,"internal_url":null},{"position":20,"raw":"[Zagoruyko and Komodakis, 2016] Sergey Zagoruyko and Nikos Komodakis. Wide residual networks. arXiv preprint arXiv:1605.07146, 2016.","title":"Wide residual networks","authors":"Sergey Zagoruyko, Nikos Komodakis","year":"2016","venue":null,"doi":null,"url":null,"internal_url":null},{"position":21,"raw":"[Zhai et al., 2019] Runtian Zhai, Tianle Cai, Di He, Chen Dan, Kun He, John Hopcroft, and Liwei Wang. Adver- sarially robust generalization just requires more unlabeled data. arXiv preprint arXiv:1906.00555, 2019.","title":"Adversarially robust generalization just requires more unlabeled data","authors":"Zhai","year":"2019","venue":null,"doi":null,"url":null,"internal_url":null},{"position":22,"raw":"[Zhang and Xu, 2019] Haichao Zhang and Wei Xu. Adver- sarial interpolation training: A simple approach for im- proving model robustness. 2019.","title":"Adversarial interpolation training: A simple approach for improving model robustness","authors":"Xu ; ] Haichao Zhang, Wei Zhang, Xu","year":"2019","venue":null,"doi":null,"url":null,"internal_url":null},{"position":23,"raw":"[Zhang et al., 2019] Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In International Conference on Machine Learn- ing, pages 7472-7482. PMLR, 2019.","title":"Theoretically principled trade-off between robustness and accuracy","authors":"Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, Michael Jordan","year":"2019","venue":"International Conference on Machine Learning","doi":null,"url":null,"internal_url":null},{"position":24,"raw":"[Zhang et al., 2020] Jingfeng Zhang, Jianing Zhu, Gang Niu, Bo Han, Masashi Sugiyama, and Mohan Kankanhalli. Geometry-aware instance-reweighted adversarial training. arXiv preprint arXiv:2010.01736, 2020.","title":"Geometry-aware instance-reweighted adversarial training","authors":"Jingfeng Zhang, Jianing Zhu, Gang Niu, Bo Han, Masashi Sugiyama, Mohan Kankanhalli","year":"2020","venue":null,"doi":null,"url":null,"internal_url":null},{"position":25,"raw":"[Zhou et al., 2021] Dawei Zhou, Nannan Wang, Bo Han, and Tongliang Liu. Modeling adversarial noise for adversarial defense. arXiv preprint arXiv:2109.09901, 2021.","title":"Modeling adversarial noise for adversarial defense","authors":"Dawei Zhou, Nannan Wang, Bo Han, Tongliang Liu","year":"2021","venue":null,"doi":null,"url":null,"internal_url":null}],"license_note":"Copyright International Joint Conferences on Artificial Intelligence."}