Closed YinghuaGao closed 2 years ago
I think it is quite hard to utilize only adversarial examples, to improve clean accuracy, which means the model does not know what is "normal" images. I think the model could only understand what the data it has ever seen, unless people give some prior knowledge, which is hard for adversarial examples.
Anyway, I didn't continue to follow up this work, and the understanding above might not be correct. If you have questions, we still could discuss.
Thanks for your response. Maybe I did not make my questions clear. I notice the results reported in advprop paper are mainly about clean accuracy. If we want to evaluate the robust accuracy of advprop. How should we generate adversarial examples with the trained model in a PGD style? When we intend to generate the adversarial example of a clean test input, should we use the auxiliary BNs rather than the main BNs in the forward process? And if we regard advprop as a standard training strategy, what is the adversarial training variant of advprop? Looking forward to your advice.
If there is any other questions, feel free to ask it.
Hi, Yucheng,
Thanks for your nice implementations of advprop. I have a question about performing adversarial training with advprop. In standard training, the clean data pass the main BNs and the generated adversarial data pass the auxiliary BNs. However, if we perform adversarial training, only the adversarial data will be used. So how can we perform adversarial training with advprop?