Reproduce “Generating Adversarial Samples in Mini-Batches May Be Detrimental To Adversarial Robustness” on OpenResearch

About this paper

Timothy Redgrave, Colton Crum

Research by Timothy Redgrave and Colton Crum from the University of Notre Dame identified that standard mean loss in mini-batch adversarial generation inadvertently weakens attacks, leading to overestimated model robustness. They demonstrate that replacing mean loss with a 'total loss' formulation ensures consistent attack strength across various batch sizes, providing a more accurate assessment of model vulnerability.

Key insights

• The 1/N normalization in the standard mean loss formulation for adversarial generation effectively reduces the gradient magnitude, creating a vanishing gradient effect that weakens attacks as batch size increases.
• Replacing mean loss with 'total loss' (removing the 1/N normalization) maintains consistent gradient magnitude and thus consistent attack strength across all batch sizes.
• The impact of the mean loss formulation is so substantial that batch-corrected adversarial samples generated with lower (16-bit) precision can still outperform baseline samples generated with full (32-bit) precision at larger batch sizes.

Summary by alphaXiv.