Parameter Interpolation Adversarial Training for Robust Image Classification

TL;DR

This paper introduces Parameter Interpolation Adversarial Training (PIAT), a novel method that interpolates model parameters between epochs to improve robustness against adversarial attacks in image classification.

Contribution

PIAT is a new adversarial training framework that mitigates overfitting and oscillations, leading to better convergence and higher robustness in CNNs and ViTs.

Findings

PIAT significantly improves model robustness on benchmark datasets.

PIAT reduces overfitting and training oscillations.

Using NMSE further enhances robustness by aligning logits.

Abstract

Though deep neural networks exhibit superior performance on various tasks, they are still plagued by adversarial examples. Adversarial training has been demonstrated to be the most effective method to defend against adversarial attacks. However, existing adversarial training methods show that the model robustness has apparent oscillations and overfitting issues in the training process, degrading the defense efficacy. To address these issues, we propose a novel framework called Parameter Interpolation Adversarial Training (PIAT). PIAT tunes the model parameters between each epoch by interpolating the parameters of the previous and current epochs. It makes the decision boundary of model change more moderate and alleviates the overfitting issue, helping the model converge better and achieving higher model robustness. In addition, we suggest using the Normalized Mean Square Error (NMSE) to further improve the robustness by aligning the relative magnitude of logits between clean and adversarial examples rather than the absolute magnitude. Extensive experiments conducted on several benchmark datasets demonstrate that our framework could prominently improve the robustness of both Convolutional Neural Networks (CNNs) and Vision Transformers (ViTs).