Outlier Robust Adversarial Training

TL;DR

This paper introduces Outlier Robust Adversarial Training (ORAT), a novel method combining robustness to outliers and adversarial attacks through a bi-level optimization with theoretical guarantees and effective empirical performance.

Contribution

We develop ORAT, a new adversarial training approach that simultaneously addresses outliers and adversarial attacks, with proven theoretical properties and practical effectiveness.

Findings

ORAT achieves superior robustness against outliers and adversarial samples.

Theoretical analysis confirms ORAT's consistency and generalization bounds.

Experimental results on benchmark datasets demonstrate ORAT's effectiveness.

Abstract

Supervised learning models are challenged by the intrinsic complexities of training data such as outliers and minority subpopulations and intentional attacks at inference time with adversarial samples. While traditional robust learning methods and the recent adversarial training approaches are designed to handle each of the two challenges, to date, no work has been done to develop models that are robust with regard to the low-quality training data and the potential adversarial attack at inference time simultaneously. It is for this reason that we introduce Outlier Robust Adversarial Training (ORAT) in this work. ORAT is based on a bi-level optimization formulation of adversarial training with a robust rank-based loss function. Theoretically, we show that the learning objective of ORAT satisfies the $\mathcal{H}$-consistency in binary classification, which establishes it as a proper surrogate to adversarial 0/1 loss. Furthermore, we analyze its generalization ability and provide uniform convergence rates in high probability. ORAT can be optimized with a simple algorithm. Experimental evaluations on three benchmark datasets demonstrate the effectiveness and robustness of ORAT in handling outliers and adversarial attacks. Our code is available at https://github.com/discovershu/ORAT.