Adversarial training has been demonstrated as one of the most effective methods for training robust models so as to defend against adversarial examples. However, adversarially trained models often lack adversarially robust generalization on unseen testing data. Recent works show that adversarially trained models are more biased towards global structure features. Instead, in this work, we would like to investigate the relationship between the generalization of adversarial training and the robust local features, as the robust local features generalize well for unseen shape variation. To learn the robust local features, we develop a Random Block Shuffle (RBS) transformation to break up the global structure features on normal adversarial examples. We continue to propose a new approach called Robust Local Features for Adversarial Training (RLFAT), which first learns the robust local features by adversarial training on the RBS-transformed adversarial examples, and then transfers the robust local features into the training of normal adversarial examples. To demonstrate the generality of our argument, we implement RLFAT in two currently state-of-the-art adversarial training frameworks. Extensive experiments on STL-10, CIFAR-10, CIFAR-100 datasets show that RLFAT significantly improves both the adversarially robust generalization and the standard generalization of adversarial training. Additionally, we demonstrate that our models capture more local features of the object on the images, aligning better with human perception.
In this paper, the authors proposed a new approach to improve the robustness of CNNs against adversarial examples.
The recent studies show that CNNs capture local features, which can be easily affected by the adversarial perturbations.
Thus, in the paper, the authors proposed to train CNNs so that they can capture local features that are robust against the adversarial perturbations.
The difficulty here is that existing adversarial training algorithms tend to bias CNNs to ignore local features and to capture only global features.
To avoid this unfavorable property of the adversarial training, the authors proposed the random block shuffle (RBS) that intensionally destroys the global feature of the images.
The authors demonstrated that combining RBS with the existing adversarial training algorithms can lead to robust CNNs.
I found the paper well-written and the idea is easy to follow.
Especially, the use of RBS seems to be an interesting idea.
As a small downside, the proposed approach looks rather straightforward, and I expect to see any theoretical foundations if possible.
### Updated after author response ###
In summary, the contribution of this study is in twofolds.
1. Proposed an algorithm for learning robust local features.
2. Demonstrated that learning robust local features is effective to improve the robustness of the model.
The possible downside is
3. The proposed approach looks straightforward.
Overall, I like the paper (especially for the reason 2 above), and therefore keep my score.