We report competitive results on RobustBench for CIFAR and SVHN using a
simple yet effective baseline approach. Our approach involves a training
protocol that integrates rescaled square loss, cyclic learning rates, and
erasing-based data augmentation. The outcomes we have achieved are comparable
to those of the model trained with state-of-the-art techniques, which is
currently the predominant choice for adversarial training. Our baseline,
referred to as SimpleAT, yields three novel empirical insights. (i) By
switching to square loss, the accuracy is comparable to that obtained by using
both de-facto training protocol plus data augmentation. (ii) One cyclic
learning rate is a good scheduler, which can effectively reduce the risk of
robust overfitting. (iii) Employing rescaled square loss during model training
can yield a favorable balance between adversarial and natural accuracy. In
general, our experimental results show that SimpleAT effectively mitigates
robust overfitting and consistently achieves the best performance at the end of
training. For example, on CIFAR-10 with ResNet-18, SimpleAT achieves
approximately 52% adversarial accuracy against the current strong AutoAttack.
Furthermore, SimpleAT exhibits robust performance on various image corruptions,
including those commonly found in CIFAR-10-C dataset. Finally, we assess the
effectiveness of these insights through two techniques: bias-variance analysis
and logit penalty methods. Our findings demonstrate that all of these simple
techniques are capable of reducing the variance of model predictions, which is
regarded as the primary contributor to robust overfitting. In addition, our
analysis also uncovers connections with various advanced state-of-the-art
methods.

使用简单有效的基线方法，通过将调整后的平方损失、循环学习速率和 Erasing 数据增强相结合的训练协议，取得了 CIFAR 和 SVHN 的 RobustBench 上有竞争力的结果。

用简单基线重新思考对抗性训练

Rethinking Adversarial Training with A Simple Baseline

It has been recognized that the data generated by the denoising diffusion
probabilistic model (DDPM) improves adversarial training. After two years of
rapid development in diffusion models, a question naturally arises: can better
diffusion models further improve adversarial training? This paper gives an
affirmative answer by employing the most recent diffusion model which has
higher efficiency ($\sim 20$ sampling steps) and image quality (lower FID
score) compared with DDPM. Our adversarially trained models achieve
state-of-the-art performance on RobustBench using only generated data (no
external datasets). Under the $\ell_\infty$-norm threat model with
$\epsilon=8/255$, our models achieve $70.69\%$ and $42.67\%$ robust accuracy on
CIFAR-10 and CIFAR-100, respectively, i.e. improving upon previous
state-of-the-art models by $+4.58\%$ and $+8.03\%$. Under the $\ell_2$-norm
threat model with $\epsilon=128/255$, our models achieve $84.86\%$ on CIFAR-10
($+4.44\%$). These results also beat previous works that use external data. Our
code is available at this https URL.

本文采用最新的扩散模型来改善对抗训练并且在 RobustBench 上取得了最先进的性能，并且使用生成数据即可实现，达到了 70.69％和 42.67％的鲁棒准确率。

更好的扩散模型进一步改善对抗训练

Better Diffusion Models Further Improve Adversarial Training

Recently, RobustBench (Croce et al. 2020) has become a widely recognized
benchmark for the adversarial robustness of image classification networks. In
its most commonly reported sub-task, RobustBench evaluates and ranks the
adversarial robustness of trained neural networks on CIFAR10 under AutoAttack
(Croce and Hein 2020b) with l-inf perturbations limited to eps = 8/255. With
leading scores of the currently best performing models of around 60% of the
baseline, it is fair to characterize this benchmark to be quite challenging.
Despite its general acceptance in recent literature, we aim to foster
discussion about the suitability of RobustBench as a key indicator for
robustness which could be generalized to practical applications. Our line of
argumentation against this is two-fold and supported by excessive experiments
presented in this paper: We argue that I) the alternation of data by AutoAttack
with l-inf, eps = 8/255 is unrealistically strong, resulting in close to
perfect detection rates of adversarial samples even by simple detection
algorithms and human observers. We also show that other attack methods are much
harder to detect while achieving similar success rates. II) That results on
low-resolution data sets like CIFAR10 do not generalize well to higher
resolution images as gradient-based attacks appear to become even more
detectable with increasing resolutions.

本篇研究讨论了 RobustBench 在实际应用中作为鲁棒性关键指标的适用性，通过对该平台中数据更改和分辨率等方面的分析实验，提出了两个观点：一是数据更改强度过大，无法反映真实情况；二是基于梯度的攻击在低分辨率上表现较好，但对于高分辨率数据不具有泛化能力。