Two Heads are Better than One: Robust Learning Meets Multi-branch Models

TL;DR

This paper introduces BORT, a multi-branch neural network approach with orthogonal solution spaces, achieving state-of-the-art adversarial robustness on CIFAR datasets without extra data.

Contribution

We propose a novel multi-branch model with branch-orthogonal loss to enhance adversarial robustness, surpassing existing methods without using additional training data.

Findings

Achieves 67.3% robust accuracy on CIFAR-10

Achieves 41.5% robust accuracy on CIFAR-100

Outperforms all state-of-the-art methods without extra data

Abstract

Deep neural networks (DNNs) are vulnerable to adversarial examples, in which DNNs are misled to false outputs due to inputs containing imperceptible perturbations. Adversarial training, a reliable and effective method of defense, may significantly reduce the vulnerability of neural networks and becomes the de facto standard for robust learning. While many recent works practice the data-centric philosophy, such as how to generate better adversarial examples or use generative models to produce additional training data, we look back to the models themselves and revisit the adversarial robustness from the perspective of deep feature distribution as an insightful complementarity. In this paper, we propose \textit{Branch Orthogonality adveRsarial Training} (BORT) to obtain state-of-the-art performance with solely the original dataset for adversarial training. To practice our design idea of integrating multiple orthogonal solution spaces, we leverage a simple multi-branch neural network and propose a corresponding loss function, branch-orthogonal loss, to make each solution space of the multi-branch model orthogonal. We evaluate our approach on CIFAR-10, CIFAR-100 and SVHN against $\ell_{\infty}$ norm-bounded perturbations of size $\epsilon = 8/255$, respectively. Exhaustive experiments are conducted to show that our method goes beyond all state-of-the-art methods without any tricks. Compared to all methods that do not use additional data for training, our models achieve 67.3\% and 41.5\% robust accuracy on CIFAR-10 and CIFAR-100 (improving upon the state-of-the-art by +7.23\% and +9.07\%).