AT‐AER: Adversarial Training With Adaptive Example Reuse

ABSTRACT Adversarial training (AT) is widely regarded as a crucial defense method for deep neural networks against adversarial attacks. Most of the existing AT methods suffer from the problems of insufficient coverage of perturbation space and robust overfitting. In view of this, we propose an AT framework with adaptive example reuse (AT‐AER) to help improve the adversarial robustness of deep models. In AT‐AER, a new concept named 2nd‐order adversarial example (AE) is proposed by adaptively filtering AEs generated during the historical training phase, which achieves sufficient coverage of diverse attack directions. Meanwhile, by analysing the fundamental causes of robust overfitting, we propose the strategies of wave descending learning rate (WDLR), cosine increasing weight decay (CIWD) and cosine increasing attack strength (CIAS) in collaboration with AT‐AER to optimise models. In addition, the Stochastic Weight Averaging (SWA) technique is introduced to further improve the stability of training. Finally, experiments on three benchmark datasets show that AT‐AER exhibits significant advantages in the face of strong adversarial attacks. Its adaptive mechanism effectively alleviates the phenomenon of robust overfitting where the performance difference between the best model and the last model is less than 1%. The study further reveals that using traditional weak attacks (e.g., FGSM) to evaluate the robustness of models may lead to a false sense of reliability, indicating the necessity of using strong attacks for robustness evaluation. This study provides a solution for AT that balances efficiency and performance.