Adversarial training with distribution normalization and margin balance. (April 2023)

• Record Type: Journal Article
• Authors: Cheng, Zhen; Zhu, Fei; Zhang, Xu-Yao; Liu, Cheng-Lin
• Is Part Of: Pattern recognition. Volume 136(2023)
• Publication Date: 2023-04
• Subjects: Adversarial robustness -- Adversarial training -- Distribution normalization -- Margin balance; Pattern perception -- Periodicals; Perception des structures -- Périodiques; Patroonherkenning; 006.4
• DOI: 10.1016/j.patcog.2022.109182
• Languages: English
• ISSNs: 0031-3203

Abstract

Highlights: We propose distribution normalization to constrain the covariance to be an identity matrix to eliminate the vulnerability induced by features with smaller variance and provide a theoretical explanation. We incorporate margin balance to enlarge the minimal margin of classes to boost adversarial robustness, contributing to an equal margin between classes. We show that DNMB achieves better adversarial robustness than state-of-the-art methods under white-box attacks, black-box attacks, adaptive attacks, unseen attacks, and common corruptions. Abstract: Adversarial training is the most effective method to improve adversarial robustness. However, it does not explicitly regularize the feature space during training. Adversarial attacks usually move a sample iteratively along the direction which causes the steepest ascent of classification loss by crossing decision boundary. To alleviate this problem, we propose to regularize the distributions of different classes to increase the difficulty of finding an attacking direction. Specifically, we propose two strategies named Distribution Normalization (DN) and Margin Balance (MB) for adversarial training. The purpose of DN is to normalize the features of each class to have identical variance in every direction, in order to eliminate easy-to-attack intra-class directions. The purpose of MB is to balance the margins between different classes, making it harder to find confusing class directions (i.e., those with smaller margins) to attack. When integrated with adversarial training, our method can significantly improve adversarial robustness. Extensive experiments under white-box, black-box, and adaptive attacks demonstrate the effectiveness of our method over other state-of-the-art methods.