_:n6921723ffdd64b259fcfb202929b506axb63
<http://schema.org/description>
"Adversarial training based on the minimax formulation is necessary for\nobtaining adversarial robustness of trained models. However, it is conservative\nor even pessimistic so that it sometimes hurts the natural generalization. In\nthis paper, we raise a fundamental question—do we have to trade off natural\ngeneralization for adversarial robustness? We argue that adversarial training\nis to employ confident adversarial data for updating the current model. We\npropose a novel approach of friendly adversarial training (FAT): rather than\nemploying most adversarial data maximizing the loss, we search for least\nadversarial (i.e., friendly adversarial) data minimizing the loss, among the\nadversarial data that are confidently misclassified. Our novel formulation is\neasy to implement by just stopping the most adversarial data searching\nalgorithms such as PGD (projected gradient descent) early, which we call\nearly-stopped PGD. Theoretically, FAT is justified by an upper bound of the\nadversarial risk. Empirically, early-stopped PGD allows us to answer the\nearlier question negatively—adversarial robustness can indeed be achieved\nwithout compromising the natural generalization."
<https://deepai.org/profile/lizhen-cui>