Improving Adversarial Training From the Perspective of Class-Flipping Distribution

Area of Science:

• Computer Science
• Artificial Intelligence
• Machine Learning

Background:

• Adversarial training is a key defense against adversarial noise.
• Existing methods require deeper exploration of class-flipping patterns for enhanced robustness.

Purpose of the Study:

• To model and analyze class-flipping distributions in adversarial settings.
• To propose a novel adversarial training method that accounts for class-flipping characteristics.

Main Methods:

• Statistical modeling of class-flipping distributions to identify misleading categories.
• Development of Class-Flipping-aware Adversarial Training (CFAT).
• CFAT utilizes targeted adversarial samples and dynamically scaled perturbation budgets based on class-flipping proportions.

Main Results:

• Identified two key shortcomings in class-flipping distributions: presence of highly misleading categories and significant inter-class variation in flipping trends.
• Demonstrated the effectiveness of the proposed CFAT method through experiments on datasets with varying class numbers.

Conclusions:

• Class-flipping patterns provide valuable insights for improving adversarial robustness.
• CFAT offers a more effective defense strategy by explicitly addressing class-flipping phenomena.