Using Single-Step Adversarial Training to Defend Iterative Adversarial Examples

TL;DR

This paper introduces a novel single-step adversarial training method that effectively defends against both single-step and iterative adversarial examples, reducing training time and improving robustness over existing methods.

Contribution

The paper proposes a new single-step adversarial training approach that outperforms state-of-the-art methods in defending against various adversarial attacks with less computational cost.

Findings

Achieves 35.67% higher test accuracy on CIFAR10 compared to ATDA.

Reduces training time by up to 76.03% relative to iterative methods.

Effectively defends against both single-step and iterative adversarial examples.

Abstract

Adversarial examples have become one of the largest challenges that machine learning models, especially neural network classifiers, face. These adversarial examples break the assumption of attack-free scenario and fool state-of-the-art (SOTA) classifiers with insignificant perturbations to human. So far, researchers achieved great progress in utilizing adversarial training as a defense. However, the overwhelming computational cost degrades its applicability and little has been done to overcome this issue. Single-Step adversarial training methods have been proposed as computationally viable solutions, however they still fail to defend against iterative adversarial examples. In this work, we first experimentally analyze several different SOTA defense methods against adversarial examples. Then, based on observations from experiments, we propose a novel single-step adversarial training method which can defend against both single-step and iterative adversarial examples. Lastly, through extensive evaluations, we demonstrate that our proposed method outperforms the SOTA single-step and iterative adversarial training defense. Compared with ATDA (single-step method) on CIFAR10 dataset, our proposed method achieves 35.67% enhancement in test accuracy and 19.14% reduction in training time. When compared with methods that use BIM or Madry examples (iterative methods) on CIFAR10 dataset, it saves up to 76.03% in training time with less than 3.78% degeneration in test accuracy.