Understanding the robustness-accuracy tradeoff by rethinking robust fairness

Zihui Wu, Haichang Gao, Shudong Zhang, Yipeng Gao

Keywords: Adversarial training, Adversarial robustness

Abstract:

Although current adversarial training (AT) methods can effectively improve the robustness on adversarial examples,
they usually lead to a decrease in accuracy, called the robustness-accuracy trade-off. In addition, researchers have recently discovered a robust fairness phenomenon in the AT model; that is, not all categories of the dataset have experienced a serious decline in accuracy with the introduction of AT methods. In this paper, we explore the relationship between the robustness-accuracy tradeoff and robust fairness for the first time. Empirically, we have found that AT will cause a substantial increase in the inter-class similarity, which could be the root cause of these two phenomena. We argue that the label smoothing (LS) is more than a trick in AT. The smoothness learned from LS can help reduce the excessive inter-class similarity caused by AT, and also reduce the intra-class variance, thereby significantly improving accuracy. Then, we explored the effect of another classic smoothing regularizer, namely, the maximum entropy (ME), and we have found ME can also help reduce both inter-class similarity and intra-class variance. Additionally, we revealed that TRADES actually implies the function of ME,
which can explain why TRADES usually performs better than PGD-AT on robustness. Finally, we proposed the maximum entropy PGD-AT (ME-AT) and the maximum entropy TRADES (ME-TRADES), and experimental results show that our methods can significantly mitigate both tradeoff and robust fairness.

One-sentence Summary: We show both the robustness-accuracy tradeoff and robust fairness stem from the increased inter-class similarity caused by AT, and we find smoothing regularizer helps reduce the inter-class similarity, thus mitigate the tradeoff & robust fairness.