English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

Transferability is the property of adversarial examples to be misclassifiedby other models than the surrogate model for which they were crafted. Previousresearch has shown that transferability is substantially increased when thetraining of the surrogate model has been early stopped. A common hypothesis toexplain this is that the later training epochs are when models learn thenon-robust features that adversarial attacks exploit. Hence, an early stoppedmodel is more robust (hence, a better surrogate) than fully trained models. Wedemonstrate that the reasons why early stopping improves transferability lie inthe side effects it has on the learning dynamics of the model. We first showthat early stopping benefits transferability even on models learning from datawith non-robust features. We then establish links between transferability andthe exploration of the loss landscape in the parameter space, on which earlystopping has an inherent effect. More precisely, we observe thattransferability peaks when the learning rate decays, which is also the time atwhich the sharpness of the loss significantly drops. This leads us to proposeRFN, a new approach for transferability that minimizes loss sharpness duringtraining in order to maximize transferability. We show that by searching forlarge flat neighborhoods, RFN always improves over early stopping (by up to 47points of transferability rate) and is competitive to (if not better than)strong state-of-the-art baselines.

Going Further: Flatness at the Rescue of Early Stopping for Adversarial Example Transferability