Adversarial robustness is essential for security and reliability of machine
learning systems. However, the adversarial robustness gained by sophisticated
defense algorithms is easily erased as the neural network evolves to learn new
tasks. This vulnerability can be addressed by fostering a novel capability for
neural networks, termed continual robust learning, which focuses on both the
(classification) performance and adversarial robustness on previous tasks
during continuous learning. To achieve continuous robust learning, we propose
an approach called Double Gradient Projection that projects the gradients for
weight updates orthogonally onto two crucial subspaces -- one for stabilizing
the smoothed sample gradients and another for stabilizing the final outputs of
the neural network. The experimental results on four benchmarks demonstrate
that the proposed approach effectively maintains continuous robustness against
strong adversarial attacks, outperforming the baselines formed by combining the
existing defense strategies and continual learning methods.

机器学习系统的安全性和可靠性需要对抗鲁棒性。然而，由于神经网络在学习新任务时容易忘记先前的对抗鲁棒性，复杂的防御算法所获得的对抗鲁棒性很容易被抹去。为了解决这个问题，我们提出了一种名为 “双梯度投影” 的方法，通过将权重更新的梯度正交投影到两个关键子空间上，实现连续鲁棒学习，这两个子空间一个用于稳定平滑的样本梯度，另一个用于稳定神经网络的最终输出。四个基准测试的实验结果表明，我们提出的方法有效地保持了连续鲁棒性，对抗强对抗攻击的效果优于结合现有防御策略和连续学习方法的基准线组成的方法。