To enhance adversarial robustness, adversarial training learns deep neural networks on the adversarial variants generated by their natural data. However, as the training progresses, the training data becomes less and less attackable, undermining the robustness enhancement. A straightforward remedy is to incorporate more training data, but sometimes incurring an unaffordable cost. In this paper, to mitigate this issue, we propose the guided interpolation framework (GIF): in each epoch, the GIF employs the previous epoch's meta information to guide the data's interpolation. Compared with the vanilla mixup, the GIF can provide a higher ratio of attackable data, which is beneficial to the robustness enhancement; it meanwhile mitigates the model's linear behavior between classes, where the linear behavior is favorable to generalization but not to the robustness. As a result, the GIF encourages the model to predict invariantly in the cluster of each class. Experiments demonstrate that the GIF can indeed enhance adversarial robustness on various adversarial training methods and various datasets.

本文提出了一种Guided Interpolation Framework （GIF）框架，该框架利用前一轮epoch的meta信息来引导数据插值，达到提高可攻击性数据的比例从而增强鲁棒性、减少模型各类之间的线性关系、鼓励模型在每个类别簇中不变地进行预测的目的。实验证明，GIF确实可以在各种Adversarial Training方法和各种数据集上增强对抗鲁棒性。

对抗性训练的向导插值方法