RAMP: Boosting Adversarial Robustness Against Multiple lₚ Perturbations

There is considerable work on improving robustness against adversarial attacks bounded by a single lₚ norm using adversarial training (AT). However, the multiple-norm robustness (union accuracy) of AT models is still low. We observe that simultaneously obtaining good union and clean accuracy is hard since there are tradeoffs between robustness against multiple lₚ perturbations, and accuracy/robustness/efficiency. By analyzing the tradeoffs from the lens of distribution shifts, we identify the key tradeoff pair among lₚ attacks to boost efficiency and design a logit pairing loss to improve the union accuracy. Next, we connect natural training with AT via gradient projection, to find and incorporate useful information from natural training into AT, which moderates the accuracy/robustness tradeoff. Combining our contributions, we propose a framework called RAMP, to boost the robustness against multiple lₚ perturbations. We show RAMP can be easily adapted for both robust fine-tuning and full AT. For robust fine-tuning, RAMP obtains a union accuracy up to $53.5%$ on CIFAR-10, and $29.7%$ on ImageNet. For training from scratch, RAMP achieves SOTA union accuracy of $44.6%$ and relatively good clean accuracy of $81.2%$ on ResNet-18 against AutoAttack on CIFAR-10.