Doubly Robust Instance-Reweighted Adversarial Training

TL;DR

This paper introduces a doubly-robust instance reweighted adversarial training framework that leverages distributionally robust optimization to improve model robustness, especially on vulnerable data points, with theoretical guarantees.

Contribution

It proposes a novel importance weighting method based on DRO techniques with convergence guarantees, addressing heuristic limitations of prior methods.

Findings

Outperforms state-of-the-art methods in average robust accuracy.

Enhances robustness on the most vulnerable data points.

Provides theoretical convergence guarantees for the algorithm.

Abstract

Assigning importance weights to adversarial data has achieved great success in training adversarially robust networks under limited model capacity. However, existing instance-reweighted adversarial training (AT) methods heavily depend on heuristics and/or geometric interpretations to determine those importance weights, making these algorithms lack rigorous theoretical justification/guarantee. Moreover, recent research has shown that adversarial training suffers from a severe non-uniform robust performance across the training distribution, e.g., data points belonging to some classes can be much more vulnerable to adversarial attacks than others. To address both issues, in this paper, we propose a novel doubly-robust instance reweighted AT framework, which allows to obtain the importance weights via exploring distributionally robust optimization (DRO) techniques, and at the same time boosts the robustness on the most vulnerable examples. In particular, our importance weights are obtained by optimizing the KL-divergence regularized loss function, which allows us to devise new algorithms with a theoretical convergence guarantee. Experiments on standard classification datasets demonstrate that our proposed approach outperforms related state-of-the-art baseline methods in terms of average robust performance, and at the same time improves the robustness against attacks on the weakest data points. Codes will be available soon.