提出新方法缓解对抗训练中标准与对抗损失的梯度冲突
Conflict-Aware Adversarial Training
- 引入冲突感知因子调节标准与对抗损失的权重组合
- 在多种设置下实现标准性能与鲁棒性的更好平衡
- 适合关注模型鲁棒性提升的研究者和实践者
对抗训练通过在训练中直接引入对抗样本，是提升深度神经网络对抗鲁棒性的最有效方法。为获得准确且鲁棒的模型，通常采用加权平均法同时优化标准损失和对抗损失。本文指出，该方法无法在标准性能与对抗鲁棒性之间取得最优权衡。我们论证其失败原因在于标准损失与对抗损失梯度间的冲突，并理论与实证证明该冲突随攻击预算增大而加剧。为此，我们提出一种新的对抗训练权衡范式——冲突感知对抗训练（Conflict-Aware Adversarial Training, CA-AT），引入冲突感知因子对标准与对抗损失进行凸组合。大量实验表明，无论从头训练还是参数高效微调，CA-AT均能持续提供更优的标准性能与对抗鲁棒性权衡。
原文摘要 · Abstract (English)
Adversarial training is the most effective method to obtain adversarial robustness for deep neural networks by directly involving adversarial samples in the training procedure. To obtain an accurate and robust model, the weighted-average method is applied to optimize standard loss and adversarial loss simultaneously. In this paper, we argue that the weighted-average method does not provide the best tradeoff for the standard performance and adversarial robustness. We argue that the failure of the weighted-average method is due to the conflict between the gradients derived from standard and adversarial loss, and further demonstrate such a conflict increases with attack budget theoretically and practically. To alleviate this problem, we propose a new trade-off paradigm for adversarial training with a conflict-aware factor for the convex combination of standard and adversarial loss, named \textbf{Conflict-Aware Adversarial Training~(CA-AT)}. Comprehensive experimental results show that CA-AT consistently offers a superior trade-off between standard performance and adversarial robustness under the settings of adversarial training from scratch and parameter-efficient finetuning.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。