Despite of the empirical success in various domains, it has been revealed that deep neural networks are vulnerable to maliciously perturbed input data that much degrade their performance. This is known as adversarial attacks. To counter adversarial attacks, adversarial training formulated as a form of robust optimization has been demonstrated to be effective. However, conducting adversarial training brings much computational overhead compared with standard training. In order to reduce the computational cost, we propose a simple yet effective modification to the commonly used projected gradient descent (PGD) adversarial training by increasing the number of adversarial training steps and decreasing the adversarial training step size gradually as training proceeds. We analyze the optimality of this annealing mechanism through the lens of optimal control theory, and we also prove the convergence of our proposed algorithm. Numerical experiments on standard datasets, such as MNIST and CIFAR10, show that our method can achieve similar or even better robustness with around 1/3 to 1/2 computation time compared with PGD.
The submission follows a recent line of work that formulates adversarial training (https://arxiv.org/abs/1412.6572) as a differentiable game and attempts to reduce the computational complexity of solving the inner maximization, corresponding to finding (an) adversarial example(s) for a given parameter setting. The authors propose a way to anneal the truncation of the inner iteration, and investigate a quantity to represent the suboptimality of the truncation.
Strengths:
- (From Table 3), the method is competitive with adversarial training (PGD; Madry et al. (2017)) as well as an improved method for adversarial robustness (FOSC; Wang et al. (2019)), while requiring half the computation time.
- The writing is very clear.
Weaknesses:
- Significance: The technique AMATA itself, is a  heuristic to gradually increase the length of the inner loop optimization in adversarial training. It is unrelated to the optimal control formulation.
- Novelty: Much of the motivation from the perspective of an optimal control formulation of adversarial training is similar to https://arxiv.org/abs/1803.01299, including the PMP and successive approximation components; Eq. (13) of the submission is the continuous version of Theorem 2 in this paper.
- Some experimental details are missing.
- Minor clarity issues (see below).
Questions for the authors:
- Could the authors better contrast their work in reference to prior work (https://arxiv.org/abs/1803.01299)? 
- Could the authors clarify if they use random restarts for the PGD attacks? How was the number of iterations for the PGD attack (40) selected? Why was the iteration count of the PGD attack not varied?
Clarity issues:
- Please provide references for the optimal control formulation in 2.2.
- Some references to variables in the text are not made precise by identifying the variable in question (e.g.: "a set of optimal parameter choices"; "requires information on the entire training interval").
- The function of the hyperparameters \alpha, \gamma, K are not well discussed in Section 2.4.
- Reduce plot sizes and include more experimental details in the main text.