CFA: Class-wise Calibrated Fair Adversarial Training

TL;DR

This paper introduces CFA, a novel class-wise calibrated adversarial training framework that enhances both robustness and fairness across classes in deep neural networks, supported by theoretical analysis and empirical validation.

Contribution

It is the first to analyze class-specific preferences in adversarial configurations and to propose an automatic, class-wise calibration method for improved robustness and fairness.

Findings

CFA improves overall robustness compared to state-of-the-art methods.

CFA enhances fairness by balancing robustness across classes.

Experimental results on benchmark datasets validate the effectiveness of CFA.

Abstract

Adversarial training has been widely acknowledged as the most effective method to improve the adversarial robustness against adversarial examples for Deep Neural Networks (DNNs). So far, most existing works focus on enhancing the overall model robustness, treating each class equally in both the training and testing phases. Although revealing the disparity in robustness among classes, few works try to make adversarial training fair at the class level without sacrificing overall robustness. In this paper, we are the first to theoretically and empirically investigate the preference of different classes for adversarial configurations, including perturbation margin, regularization, and weight averaging. Motivated by this, we further propose a \textbf{C}lass-wise calibrated \textbf{F}air \textbf{A}dversarial training framework, named CFA, which customizes specific training configurations for each class automatically. Experiments on benchmark datasets demonstrate that our proposed CFA can improve both overall robustness and fairness notably over other state-of-the-art methods. Code is available at \url{https://github.com/PKU-ML/CFA}.