Adversarial training (AT) in order to achieve adversarial robustness wrt single $l_p$-threat models has been discussed extensively. However, for safety-critical systems adversarial robustness should be achieved wrt all $l_p$-threat models simultaneously. In this paper we develop a simple and efficient training scheme to achieve adversarial robustness against the union of $l_p$-threat models. Our novel $l_1+l_\infty$-AT scheme is based on geometric considerations of the different $l_p$-balls and costs as much as normal adversarial training against a single $l_p$-threat model. Moreover, we show that using our $l_1+l_\infty$-AT scheme one can fine-tune with just 3 epochs any $l_p$-robust model (for $p \in \{1,2,\infty\}$) and achieve multiple norm adversarial robustness. In this way we boost the previous state-of-the-art reported for multiple-norm robustness by more than $6\%$ on CIFAR-10 and report up to our knowledge the first ImageNet models with multiple norm robustness. Moreover, we study the general transfer of adversarial robustness between different threat models and in this way boost the previous SOTA $l_1$-robustness on CIFAR-10 by almost $10\%$.

本文提出了一种基于几何特性的极值范数对抗训练（E-AT）方法，不同于其他方法的是，它有效地提供了一种多范数的鲁棒性，且其训练时间仅为其他多范数对抗训练方法的三分之一，E-AT方法在ImageNet的单个epoch和CIFAR-10的三个epoch的训练下，只需要一种$l_p$对抗模型就可以将其传播到多种$l_p$威胁模型并显著提高多个$l_p$鲁棒模型在CIFAR-10上的最新技术水平。

通过快速微调强健分类器实现对抗多l𝑝威胁模型和单一l𝑝威胁模型的强健性