Abstract
Existing adversarial training (AT) methods often suffer from incomplete perturbation, meaning that not all non-robust features are perturbed when generating adversarial examples (AEs). This results in residual correlations between non-robust features and labels, leading to suboptimal learning of robust features. However, achieving complete perturbation, i.e., perturbing as many non-robust features as possible, is challenging due to the difficulty in distinguishing robust and non-robust features and the sparsity of labeled data. To address these challenges, we propose a novel approach called Weakly Supervised Contrastive Adversarial Training (WSCAT). WSCAT ensures complete perturbation for improved learning of robust features by disrupting correlations between non-robust features and labels through complete AE generation over partially labeled data, grounded in information theory. Extensive theoretical analysis and comprehensive experiments on widely adopted benchmarks validate the superiority of WSCAT.
Abstract (translated)
现有的对抗训练（AT）方法常常受到不完全扰动的困扰，这意味着在生成对抗样本（AEs）时，并非所有的非鲁棒特征都会被扰动。这导致了非鲁棒特征与标签之间的残余相关性，从而导致对鲁棒特征的学习效果不佳。然而，实现完全扰动，即尽可能多地扰动非鲁棒特征，由于难以区分鲁棒和非鲁棒特征以及标注数据的稀疏性而变得具有挑战性。 为了解决这些挑战，我们提出了一种名为弱监督对比对抗训练（WSCAT）的新方法。通过在部分标记的数据上进行完全AE生成来打破非鲁棒特征与标签之间的相关性，并基于信息理论确保完全扰动以改善对鲁棒特征的学习效果，WSCAT能够应对这一难题。 广泛的理论分析和在广泛采用的基准上的全面实验验证了WSCAT的优越性。
URL
https://arxiv.org/abs/2503.11032
