Pixel Reweighted Adversarial Training

Abstract

Adversarial training (AT) is a well-known defensive framework that trains a model with generated adversarial examples (AEs). AEs are crafted by intentionally adding perturbations to the natural images, aiming to mislead the model into making erroneous outputs. In existing AT methods, the magnitude of perturbations is usually constrained by a predefined perturbation budget, denoted as $\epsilon$, and keeps the same on each dimension of the image (i.e., each pixel within an image). However, in this paper, we discover that not all pixels contribute equally to the accuracy on AEs (i.e., robustness) and accuracy on natural images (i.e., accuracy). Motivated by this finding, we propose a new framework called Pixel-reweighted AdveRsarial Training (PART), to partially lower $\epsilon$ for pixels that rarely influence the model's outputs, which guides the model to focus more on regions where pixels are important for model's outputs. Specifically, we first use class activation mapping (CAM) methods to identify important pixel regions, then we keep the perturbation budget for these regions while lowering it for the remaining regions when generating AEs. In the end, we use these reweighted AEs to train a model. PART achieves a notable improvement in the robustness-accuracy trade-off on CIFAR-10, SVHN and Tiny-ImageNet and serves as a general framework, seamlessly integrating with a variety of AT, CAM and AE generation methods. More importantly, our work revisits the conventional AT framework and justifies the necessity to allocate distinct weights to different pixel regions during AT.