2021
DOI: 10.1609/aaai.v35i9.16989
|View full text |Cite
|
Sign up to set email alerts
|

Understanding Catastrophic Overfitting in Single-step Adversarial Training

Abstract: Although fast adversarial training has demonstrated both robustness and efficiency, the problem of "catastrophic overfitting" has been observed. This is a phenomenon in which, during single-step adversarial training, the robust accuracy against projected gradient descent (PGD) suddenly decreases to 0% after a few epochs, whereas the robust accuracy against fast gradient sign method (FGSM) increases to 100%. In this paper, we demonstrate that catastrophic overfitting is very closely related to the characteristi… Show more

Help me understand this report

Search citation statements

Order By: Relevance

Paper Sections

Select...
2
1
1

Citation Types

1
14
0

Year Published

2022
2022
2024
2024

Publication Types

Select...
5
2
2

Relationship

0
9

Authors

Journals

citations
Cited by 46 publications
(15 citation statements)
references
References 21 publications
1
14
0
Order By: Relevance
“…FAST AT [14] generates FGSM attacks with random initialization but still suffers from 'catastrophic overfitting'. Therefore, Gradient alignment regularization [17], suitable inner interval (step size) for the adversarial direction [16], and Fast Bi-level AT (FAST-BAT) [37] are proposed to prevent such failure.…”
Section: Efficient Adversarial Training Despite Pgd-based Training Sh...mentioning
confidence: 99%
See 1 more Smart Citation
“…FAST AT [14] generates FGSM attacks with random initialization but still suffers from 'catastrophic overfitting'. Therefore, Gradient alignment regularization [17], suitable inner interval (step size) for the adversarial direction [16], and Fast Bi-level AT (FAST-BAT) [37] are proposed to prevent such failure.…”
Section: Efficient Adversarial Training Despite Pgd-based Training Sh...mentioning
confidence: 99%
“…However, to achieve better defense with higher robustness, the iterative AT is required to generate stronger adversarial examples with more steps in the inner problem, leading to expensive computation costs. In response to this difficulty, a number of approaches investigate efficient AT, such as Fast AT [14] and their variants [15,16] via single-step adversarial attacks. Un-fortunately, these cheaper training approaches are known to attain poor performance on stronger adversaries and suffer from 'catastrophic overfitting' [14,17], where Projected Gradient Descent (PGD) robustness is gained at the beginning, but later the robust accuracy decreases to 0 suddenly.…”
Section: Introductionmentioning
confidence: 99%
“…Te algorithm CMP (closed-loop moment parameter identifcation) in this paper only needs to obtain the normal operating data of the system setting value change once, which means that the algorithm may lead to overftting. Tere are many studies [35][36][37] Mathematical Problems in Engineering devoted to solving the problem of overftting. In Section 3, two experiments were performed on the two systems, respectively.…”
Section: Industrial Cascade Systemmentioning
confidence: 99%
“…Such dramatic phenomenon is referred as "catastrophic overfitting" (CO) [7]. Currently, methods for resolving CO can be mainly divided into two categories: generating diverse adversarial examples [8], [9], [10] and applying proper regularization techniques [11], [12]. These methods are designed based on a consensus that DNNs lose robustness against multi-step attacks due to overfitting to single-step adversarial examples.…”
Section: Introductionmentioning
confidence: 99%