Adversarial training (AT) is currently one of the most effective ways to
obtain the robustness of deep neural networks against adversarial attacks.
However, most AT methods suffer from robust overfitting, i.e., a significant
generalization gap in adversarial robustness between the training and testing
curves. In this paper, we first identify a connection between robust
overfitting and the excessive memorization of noisy labels in AT from a view of
gradient norm. As such label noise is mainly caused by a distribution mismatch
and improper label assignments, we are motivated to propose a label refinement
approach for AT. Specifically, our Self-Guided Label Refinement first
self-refines a more accurate and informative label distribution from
over-confident hard labels, and then it calibrates the training by dynamically
incorporating knowledge from self-distilled models into the current model and
thus requiring no external teachers. Empirical results demonstrate that our
method can simultaneously boost the standard accuracy and robust performance
across multiple benchmark datasets, attack types, and architectures. In
addition, we also provide a set of analyses from the perspectives of
information theory to dive into our method and suggest the importance of soft
labels for robust generalization.

鲁棒训练是为了提高深度神经网络对抗攻击的鲁棒性的最有效方法之一，但大多数鲁棒训练方法存在鲁棒过拟合的问题。本文从梯度范数角度首次找到了鲁棒过拟合与噪声标签过渡记忆之间的联系，并提出了一种自我导向的标签优化方法，它能提高标准准确度和鲁棒性，在多个数据集、攻击类型和架构上都得到了验证。此外，从信息理论的角度对我们的方法进行了分析，并指出了软标签对于鲁棒泛化的重要性。

缓和以防御：通过自引导标签完善实现对抗鲁棒性

Soften to Defend: Towards Adversarial Robustness via Self-Guided Label  Refinement

Diffusion models have demonstrated remarkable progress in image generation
quality, especially when guidance is used to control the generative process.
However, guidance requires a large amount of image-annotation pairs for
training and is thus dependent on their availability, correctness and
unbiasedness. In this paper, we eliminate the need for such annotation by
instead leveraging the flexibility of self-supervision signals to design a
framework for self-guided diffusion models. By leveraging a feature extraction
function and a self-annotation function, our method provides guidance signals
at various image granularities: from the level of holistic images to object
boxes and even segmentation masks. Our experiments on single-label and
multi-label image datasets demonstrate that self-labeled guidance always
outperforms diffusion models without guidance and may even surpass guidance
based on ground-truth labels, especially on unbalanced data. When equipped with
self-supervised box or mask proposals, our method further generates visually
diverse yet semantically consistent images, without the need for any class,
box, or segment label annotation. Self-guided diffusion is simple, flexible and
expected to profit from deployment at scale.

本文介绍了一种自导扩散模型的方法，它可以利用自我监督信号来提供图像生成的指导，而无需大量的图像注释对。通过结合特征提取功能和自注释功能，我们的方法可以为各种图像颗粒度提供指导信号，从整体图像到对象框甚至分割掩模。我们的实验表明，我们的方法在单标签和多标签图像数据集上总是优于无指导的扩散模型，甚至可能超过基于基础真实标签的指导，特别是在不平衡数据上。