Make Some Noise: Reliable and Efficient Single-Step Adversarial Training
  Recently, Wong et al. showed that adversarial training with single-step FGSM
leads to a characteristic failure mode named catastrophic overfitting (CO), in
which a model becomes suddenly vulnerable to multi-step attacks. They showed
that adding a random perturbation prior to FGSM (RS-FGSM) seemed to be
sufficient to prevent CO. However, Andriushchenko and Flammarion observed that
RS-FGSM still leads to CO for larger perturbations, and proposed an expensive
regularizer (GradAlign) to avoid CO. In this work, we methodically revisit the
role of noise and clipping in single-step adversarial training. Contrary to
previous intuitions, we find that using a stronger noise around the clean
sample combined with not clipping is highly effective in avoiding CO for large
perturbation radii. Based on these observations, we then propose Noise-FGSM
(N-FGSM) that, while providing the benefits of single-step adversarial
training, does not suffer from CO. Empirical analyses on a large suite of
experiments show that N-FGSM is able to match or surpass the performance of
previous single-step methods while achieving a 3$\times$ speed-up.
