Recent studies have shown that deep neural networks are vulnerable to adversarial examples. Numerous defenses have been proposed to improve model robustness, among which adversarial training is most successful. In this work, we revisit the robust overfitting phenomenon. In particular, we argue that overconfident models produced during adversarial training could be a potential cause, supported by the empirical observation that the predicted labels of adversarial examples generated by models with better robust generalization ability tend to have significantly more even distributions. Based on the proposed definition of adversarial certainty, we incorporate an extragradient step in the adversarial training framework to search for models that can generate adversarially perturbed inputs with lower certainty, further improving robust generalization. Our approach is general and can be easily combined with other variants of adversarial training methods. Extensive experiments on image benchmarks demonstrate that our method effectively alleviates robust overfitting and is able to produce models with consistently improved robustness.

最近的研究表明，深度神经网络对于对抗样本存在漏洞。已经提出了许多防御方法以提高模型的鲁棒性，其中对抗训练最为成功。本文重新审视了鲁棒过拟合现象。我们认为，对抗训练过程中产生的自信模型可能是潜在的原因，通过实证观察支持，具有更好鲁棒泛化能力的模型对于对抗样本的预测标签往往具有更均匀的分布。基于对抗确立的定义，我们在对抗训练框架中引入了一个额外的梯度步骤，以寻找能够生成置信度较低的对抗扰动输入的模型，进一步提高鲁棒泛化。我们的方法具有普适性，可以轻松与其他对抗训练方法的变体结合。在图像基准实验上进行的大量实验证明了我们的方法有效地减轻了鲁棒过拟合，并能够产生鲁棒性持续提升的模型。

生成更不确定的对抗样本提高鲁棒泛化能力