Adapting to Evolving Adversaries with Regularized Continual Robust Training

TL;DR

This paper introduces a regularized continual robust training method that enhances model robustness against evolving adversarial attacks by maintaining robustness across multiple attack types through logit space regularization.

Contribution

It proposes a novel regularization technique based on logit space distance to improve robustness in continual adversarial training, supported by theoretical analysis and extensive experiments.

Findings

Regularization based on logit space distance improves robustness against multiple attacks.

The method maintains robustness on previous attacks while adapting to new ones.

Achieves better robust accuracy with minimal training overhead.

Abstract

Robust training methods typically defend against specific attack types, such as Lp attacks with fixed budgets, and rarely account for the fact that defenders may encounter new attacks over time. A natural solution is to adapt the defended model to new adversaries as they arise via fine-tuning, a method which we call continual robust training (CRT). However, when implemented naively, fine-tuning on new attacks degrades robustness on previous attacks. This raises the question: how can we improve the initial training and fine-tuning of the model to simultaneously achieve robustness against previous and new attacks? We present theoretical results which show that the gap in a model's robustness against different attacks is bounded by how far each attack perturbs a sample in the model's logit space, suggesting that regularizing with respect to this logit space distance can help maintain robustness against previous attacks. Extensive experiments on 3 datasets (CIFAR-10, CIFAR-100, and ImageNette) and over 100 attack combinations demonstrate that the proposed regularization improves robust accuracy with little overhead in training time. Our findings and open-source code lay the groundwork for the deployment of models robust to evolving attacks.