Generating Less Certain Adversarial Examples Improves Robust Generalization

2023-10-06

arXiv.org

AI Summary

This work addresses robust overfitting in adversarial training, identifying excessive model confidence—i.e., high predictive certainty—on adversarial examples as a key cause of degraded robust generalization. To this end, we formally introduce the concept of *adversarial certainty*, defined as the variance of logits on adversarial samples, and establish its theoretical connection to robust generalization performance. Building upon this insight, we propose a generic robust optimization framework that actively reduces adversarial certainty during training without compromising clean classification discriminability. Extensive experiments across multiple image classification benchmarks demonstrate that our method significantly improves robust accuracy and effectively mitigates robust overfitting. These results empirically validate that explicitly controlling adversarial uncertainty is crucial for enhancing robust generalization.

Abstract

This paper revisits the robust overfitting phenomenon of adversarial training. Observing that models with better robust generalization performance are less certain in predicting adversarially generated training inputs, we argue that overconfidence in predicting adversarial examples is a potential cause. Therefore, we hypothesize that generating less certain adversarial examples improves robust generalization, and propose a formal definition of adversarial certainty that captures the variance of the model's predicted logits on adversarial examples. Our theoretical analysis of synthetic distributions characterizes the connection between adversarial certainty and robust generalization. Accordingly, built upon the notion of adversarial certainty, we develop a general method to search for models that can generate training-time adversarial inputs with reduced certainty, while maintaining the model's capability in distinguishing adversarial examples. Extensive experiments on image benchmarks demonstrate that our method effectively learns models with consistently improved robustness and mitigates robust overfitting, confirming the importance of generating less certain adversarial examples for robust generalization. Our implementations are available as open-source code at: https://github.com/TrustMLRG/AdvCertainty.

Problem

• Addresses robust overfitting in adversarial training
• Links model overconfidence to poor generalization
• Proposes generating less certain adversarial examples

Innovation

• Generating less certain adversarial examples
• Defining adversarial certainty via logit variance
• Searching models to reduce adversarial certainty