Lagrangian Objective Function Leads to Improved Unforeseen Attack Generalization

Abstract

Recent improvements in deep learning models and their practical applications have raised concerns about the robustness of these models against adversarial examples. Adversarial training (AT) has been shown effective in reaching a robust model against the attack that is used during training. However, it usually fails against other attacks, i.e., the model overfits to the training attack scheme. In this paper, we propose a new method for generating adversarial perturbations during training that mitigates the mentioned issue. More specifically, we minimize the perturbation $\ell _p$ ℓ p norm while maximizing the classification loss in the Lagrangian form to craft adversarial examples. We argue that crafting adversarial examples based on this scheme results in enhanced attack generalization in the learned model. We compare our final model robust accuracy with the closely related state-of-the-art AT methods against attacks that were not used during training. This comparison demonstrates that our average robust accuracy against unseen attacks is 5.9% higher in the CIFAR-10 dataset and 3.2% higher in the ImageNet-100 dataset than corresponding state-of-the-art methods. We also demonstrate that our attack is faster than other attack schemes that are designed for unseen attack generalization and conclude that the proposed method is feasible for large datasets. Our code is available at https://github.com/rohban-lab/Lagrangian_Unseen .