search

KejiaZhang-Robust / AdverRobust

An Adversarial Training Framework for Adversarial Robustness in Deep Learning Models
8 stars 2 forks source link

The accuracy with image under none attack #1

Open Phd-man opened 5 days ago

Phd-man commented 5 days ago

First off, I just want to say thank you for your amazing work on this repository! I've been learning a lot from it.

I’ve noticed that no matter which method of adversarial training I use, the clean accuracy tends to be lower compared to non-adversarial scenarios. Since my project requires high clean accuracy, I was wondering if you have any tips or techniques for improving this, or if there are specific hyperparameters I should focus on tuning.

KejiaZhang-Robust commented 4 days ago

Thank you for your kind words! I’m really glad you’re finding the repository helpful. 😊

Regarding your concern about clean accuracy during adversarial training, here are a few suggestions that might help strike a better balance between clean and robust accuracy:

  1. Initialize with a naturally trained checkpoint: Starting adversarial training from weights obtained via standard (non-adversarial) training can often preserve clean accuracy to a greater extent. This approach has proven particularly effective for models like ViTs.
  2. Label smoothing: You can enable label smoothing in this project by adjusting the relevant parameters in the .yml configuration file. This technique can help reduce overfitting to adversarial samples, which may indirectly improve clean accuracy.
  3. Fine-tuning a naturally trained checkpoint: Instead of full adversarial training from scratch, fine-tuning a pre-trained natural model with adversarial training tends to improve robustness while minimizing the drop in clean accuracy. This works as a trade-off, so fine-tuning allows more control over this balance.

Let me know if you need further clarification or assistance with implementation details—I’d be happy to help!

Phd-man commented 4 days ago

I’ll definitely give them a try. Specifically, I’m using the ViT-B network—it’s a bit time-consuming, but I’ll work through it.

KejiaZhang-Robust commented 2 days ago

I’ll definitely give them a try. Specifically, I’m using the ViT-B network—it’s a bit time-consuming, but I’ll work through it.

You can reference this paper: When Adversarial Training Meets Vision Transformers: Recipes from Training to Architecture[NeurIPS-22]