# Adversarial Training for Free!

## TL;DR

This paper introduces a computationally efficient adversarial training method that significantly reduces training time while maintaining robustness, enabling large-scale adversarial training on datasets like ImageNet.

## Contribution

The authors propose a novel 'free' adversarial training algorithm that recycles gradient information to eliminate the overhead of generating adversarial examples, making large-scale robust training feasible.

## Key findings

- Achieves comparable robustness to PGD adversarial training on CIFAR datasets.
- Can train a robust ImageNet model in 2 days using modest hardware.
- Significantly reduces training time, being 7 to 30 times faster than existing methods.

## Abstract

Adversarial training, in which a network is trained on adversarial examples, is one of the few defenses against adversarial attacks that withstands strong attacks. Unfortunately, the high cost of generating strong adversarial examples makes standard adversarial training impractical on large-scale problems like ImageNet. We present an algorithm that eliminates the overhead cost of generating adversarial examples by recycling the gradient information computed when updating model parameters. Our "free" adversarial training algorithm achieves comparable robustness to PGD adversarial training on the CIFAR-10 and CIFAR-100 datasets at negligible additional cost compared to natural training, and can be 7 to 30 times faster than other strong adversarial training methods. Using a single workstation with 4 P100 GPUs and 2 days of runtime, we can train a robust model for the large-scale ImageNet classification task that maintains 40% accuracy against PGD attacks. The code is available at https://github.com/ashafahi/free_adv_train.