Geometry-Aware Weight Perturbation for Adversarial Training

Adversarial training is one of the most successful approaches to improve model robustness against maliciously crafted data. Instead of training on a clean dataset, the model is trained on adversarial data generated on the fly. Based on that, a group of geometry-aware methods are proposed to further enhance the model robustness by assigning higher weights to the data points that are closer to the decision boundary during training. Although the robustness against the adversarial attack seen in the training process is significantly improved, the model becomes more vulnerable to unseen attacks, and the reason for the issue remains unclear. In this paper, we investigate the cause of the issue and claim that such geometry-aware methods lead to a sharp minimum, which results in poor robustness generalization for unseen attacks. Furthermore, we propose a remedy for the issue by imposing the adversarial weight perturbation mechanism and further develop a novel weight perturbation strategy called Geometry-Aware Weight Perturbation (GAWP). Extensive results demonstrate that the proposed method alleviates the robustness generalization issue of geometry-aware methods while consistently improving model robustness compared to existing weight perturbation strategies.