Instance adaptive adversarial training: Improved accuracy tradeoffs in neural nets

Understand

Adversarial training is by far the most successful strategy for improving robustness of neural networks to adversarial attacks.

• Despite its success as a defense mechanism, adversarial training fails to generalize well to unperturbed test set.
• We hypothesize that this poor generalization is a consequence of adversarial training with uniform perturbation radius around every training sample.
• Samples close to decision boundary can be morphed into a different class under a small perturbation budget, and enforcing large margins around these samples produce poor decision boundaries that generalize poorly.