On the Duality Between Sharpness-Aware Minimization and Adversarial Training

arXiv:2402.15152v1 Announce Type: new
Abstract: Adversarial Training (AT), which adversarially perturb the input samples during training, has been acknowledged as one of the most effective defenses against adversarial attacks, yet suffers from a fundamental tradeoff that inevitably decreases clean accuracy. Instead of perturbing the samples, Sharpness-Aware Minimization (SAM) perturbs the model weights during training to find a more flat loss landscape and improve generalization. However, as SAM is designed for better clean accuracy, its effectiveness in enhancing adversarial robustness remains …

adversarial adversarial training arxiv cs.ai cs.cr cs.lg math.oc training type