Bridged adversarial training
Hoki Kima, Woojin Leeb, Sungyoon Leeb c✉, Sungyoon Leec d, Sungyoon Leec✉, Jaewook Leee✉
- aInstitute of Engineering Research, Seoul National University, Gwanak-gu 08826, Republic of Korea
- bSchool of AI Convergence, Dongguk University-Seoul, Jung-gu 04620, Republic of Korea
- cDepartment of Computer Science, Hanyang University, Seongdong-gu 04763, Republic of Korea
- dDepartment of Industrial Engineering, Seoul National University, Gwanak-gu 08826, Republic of Korea
- eDepartment of Industrial Engineering, Seoul National University, Gwanak-gu 08826, Republic of Korea. Electronic address: jaewook@snu.ac.kr
- ✉Corresponding author
Papers open inside SciRah from the original publisher or repository; SciRah never hosts them.
Abstract
Adversarial robustness is considered a required property of deep neural networks. In this study, we discover that adversarially trained models might have significantly different characteristics in terms of margin and smoothness, even though they show similar robustness. Inspired by the observation, we investigate the effect of different regularizers and discover the negative effect of the smoothness regularizer on maximizing the margin. Based on the analyses, we propose a new method called bridged adversarial training that mitigates the negative effect by bridging the gap between clean and adversarial examples. We provide theoretical and empirical evidence that the proposed method provides stable and better robustness, especially for large perturbations.
TL;DRThis study discovers that adversarially trained models might have significantly different characteristics in terms of margin and smoothness, even though they show similar robustness, and proposes a new method called bridged adversarial training that mitigates the negative effect by bridging the gap between clean and adversarial examples. (Semantic Scholar)