Fast adversarial training is attractive because it can obtain robustness at a fraction of the cost of multi-step adversarial training. At the same time, it can exhibit catastrophic overfitting: a model may become highly accurate against the attack used during training while failing against stronger evaluations.
Can fast training use richer attack information without losing efficiency?
This work studies whether efficient approximations to second-order attack information can make fast adversarial training more reliable and mitigate catastrophic overfitting.
SORA uses an efficient second-order attack approximation inside fast adversarial training. The project combines analysis of catastrophic overfitting with experiments across multiple datasets, architectures, and threat models.
The accompanying PyTorch codebase reimplements SORA and 14 named comparison methods in a unified framework, including FGSM, FGSM-RS, GradAlign, NuAT, ATAS, NFGSM, ZeroGrad, MultiGrad, AAER, ELLE, FreeAT, PGD-2, PGD-10, and TRADES. It supports training these methods on PreActResNet, ResNet, WideResNet, SENet, and ViT architectures across CIFAR-10/100, TinyImageNet, ImageNet100, PathMNIST, and TissueMNIST.
The repository also includes visualization code used to inspect and compare training and robustness behavior.
I conceived the core idea, derived the underlying theory, implemented the method, and co-wrote the manuscript. I also carried out extensive experimental evaluation and robustness benchmarking.
Robustness is, to me, more than a desirable property of a machine learning model. It is connected to what I expect from an intelligent system: it should not be easily fooled by superficial changes in its input. At the same time, I am interested in achieving this reliability efficiently rather than simply scaling computation.
This project strengthened my interest in the relationship between robustness and efficiency, and in understanding why a model that appears robust under one evaluation can fail under another.