Adversarial training, in which a network is trained on adversarial examples, is one of the few defenses against adversarial attacks that withstands strong attacks. Unfortunately, the high cost of generating strong adversarial examples makes standard adversarial training impractical on large-scale problems like ImageNet. We present an algorithm that eliminates the overhead cost of generating adversarial examples by recycling the gradient information computed when updating model parameters. Our "free" adversarial training algorithm achieves state-of-the-art robustness on CIFAR-10 and CIFAR-100 datasets at negligible additional cost compared to natural training, and can be 7 to 30 times faster than other strong adversarial training methods. Using a single workstation with 4 P100 GPUs and 2 days of runtime, we can train a robust model for the large-scale ImageNet classification task that maintains 40% accuracy against PGD attacks.

通过回收在更新模型参数过程中计算的渐变信息，提出了一种消除生成对抗样本开销的自由对抗训练算法，这个算法在 CIFAR-10 和 CIFAR-100 上达到了与 PGD 对抗训练相当的稳健性，其相比于自然训练的额外成本微不足道，并且可以比其他强对抗训练方法快 7 ~ 30 倍。使用单个带 4 个 P100 GPU 的工作站和 2 天运行时间，我们可以训练出针对大规模 ImageNet 分类任务的稳健模型，其对 PGD 攻击的准确率仍可保持在 40％ 左右。

免费的对抗训练！