Previous adversarial training raises model robustness under the compromise of
accuracy on natural data. In this paper, we reduce natural accuracy
degradation. We use the model logits from one clean model to guide learning of
another one robust model, taking into consideration that logits from the well
trained clean model embed the most discriminative features of natural data,
{\it e.g.}, generalizable classifier boundary. Our solution is to constrain
logits from the robust model that takes adversarial examples as input and makes
it similar to those from the clean model fed with corresponding natural data.
It lets the robust model inherit the classifier boundary of the clean model.
Moreover, we observe such boundary guidance can not only preserve high natural
accuracy but also benefit model robustness, which gives new insights and
facilitates progress for the adversarial community. Finally, extensive
experiments on CIFAR-10, CIFAR-100, and Tiny ImageNet testify to the
effectiveness of our method. We achieve new state-of-the-art robustness on
CIFAR-100 without additional real or synthetic data with auto-attack benchmark
\footnote{\url{this https URL}}. Our code is available at
\url{this https URL}.

本研究通过引入已训练的干净模型的分类边界来指导对抗训练，约束对抗性模型的 logits 与自然数据下的干净模型的 logits 相似，从而提高了模型的鲁棒性和自然数据的准确性。实验证明，该方法在 CIFAR-10、CIFAR-100 和 Tiny ImageNet 上具有新的最先进的鲁棒性，无需额外的真实或合成数据。