English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

Recently, FGSM adversarial training is found to be able to train a robustmodel which is comparable to the one trained by PGD but an order of magnitudefaster. However, there is a failure mode called catastrophic overfitting (CO)that the classifier loses its robustness suddenly during the training andhardly recovers by itself. In this paper, we find CO is not only limited toFGSM, but also happens in $\mbox{DF}^{\infty}$-1 adversarial training. Then, weanalyze the geometric properties for both FGSM and $\mbox{DF}^{\infty}$-1 andfind they have totally different decision boundaries after CO. For FGSM, a newdecision boundary is generated along the direction of perturbation and makesthe small perturbation more effective than the large one. While for$\mbox{DF}^{\infty}$-1, there is no new decision boundary generated along thedirection of perturbation, instead the perturbation generated by$\mbox{DF}^{\infty}$-1 becomes smaller after CO and thus loses itseffectiveness. We also experimentally analyze three hypotheses on potentialfactors causing CO. And then based on the empirical analysis, we modify theRS-FGSM by not projecting perturbation back to the $l_\infty$ ball. By thissmall modification, we could achieve $47.56 \pm 0.37\% $ PGD-50-10 accuracy onCIFAR10 with $\epsilon=8/255$ in contrast to $43.57 \pm 0.30\% $ by RS-FGSM andalso further extend the working range of $\epsilon$ from 8/255 to 11/255 onCIFAR10 without CO occurring.

Understanding Catastrophic Overfitting in Adversarial Training