  Due to numerous breakthroughs in real-world applications brought by machine
intelligence, deep neural networks (DNNs) are widely employed in critical
applications. However, predictions of DNNs are easily manipulated with
imperceptible adversarial perturbations, which impedes the further deployment
of DNNs and may result in profound security and privacy implications. By
incorporating adversarial samples into the training data pool, adversarial
training is the strongest principled strategy against various adversarial
attacks among all sorts of defense methods. Recent works mainly focus on
developing new loss functions or regularizers, attempting to find the unique
optimal point in the weight space. But none of them taps the potentials of
classifiers obtained from standard adversarial training, especially states on
the searching trajectory of training. In this work, we are dedicated to the
weight states of models through the training process and devise a simple but
powerful \emph{Self-Ensemble Adversarial Training} (SEAT) method for yielding a
robust classifier by averaging weights of history models. This considerably
improves the robustness of the target model against several well known
adversarial attacks, even merely utilizing the naive cross-entropy loss to
supervise. We also discuss the relationship between the ensemble of predictions
from different adversarially trained models and the prediction of
weight-ensembled models, as well as provide theoretical and empirical evidence
that the proposed self-ensemble method provides a smoother loss landscape and
better robustness than both individual models and the ensemble of predictions
from different classifiers. We further analyze a subtle but fatal issue in the
general settings for the self-ensemble model, which causes the deterioration of
the weight-ensembled method in the late phases.

Machine Learning;Cryptography and Security