Adversarial training suffers from robust overfitting, a phenomenon where the robust test accuracy starts to decrease during training. In this paper, we focus on reducing robust overfitting by using common data augmentation schemes. We demonstrate that, contrary to previous findings, when combined with model weight averaging, data augmentation can significantly boost robust accuracy. Furthermore, we compare various augmentations techniques and observe that spatial composition techniques work the best for adversarial training. Finally, we evaluate our approach on CIFAR-10 against $\ell_\infty$ and $\ell_2$ norm-bounded perturbations of size $\epsilon = 8/255$ and $\epsilon = 128/255$, respectively. We show large absolute improvements of +2.93% and +2.16% in robust accuracy compared to previous state-of-the-art methods. In particular, against $\ell_\infty$ norm-bounded perturbations of size $\epsilon = 8/255$, our model reaches 60.07% robust accuracy without using any external data. We also achieve a significant performance boost with this approach while using other architectures and datasets such as CIFAR-100, SVHN and TinyImageNet.
翻译:Aversarial培训受到强力超编的影响,这是一种强力测试精确度在培训期间开始下降的现象。在本文中,我们侧重于通过使用共同的数据增强计划减少强力超编。我们证明,与先前的调查结果相反,如果与平均模型重量相结合,数据增强可以极大地提高稳健的准确性。此外,我们比较了各种增强技术,并观察到空间构成技术对对抗性培训最有效。最后,我们对照美元=美元和美元=美元=美元=美元=美元=2255美元标准限制的冲击,评估了我们关于CFAR-10的做法。我们的模型在不使用任何外部数据的情况下达到了60.07%的稳健准确性。我们还展示了与以往最新方法相比,2.93%和+2.16%的稳健性精确性大幅提高。特别是,在以美元=美元=美元=8/N255美元为标准约束的冲击下,我们的模型在不使用任何外部数据的情况下达到了60.07%的稳健性精确性。我们还展示了这一方法在使用其他建筑和SIR-100号数据的同时,我们还取得了显著的绩效提升。