Systems and methods for fast training of more robust models against adversarial attacks

Abstract

Described herein are embodiments for fast training of adversarially robust models against adversarial attacks. Embodiments for model training by perturbing both the image and the label, which may be referred to as Bilateral Adversarial Training (BAT), are disclosed. To generate the adversarial label, one or more closed-form heuristic solutions are derived. One-step targeted attack is used with the target label being the most confusing class. It is shown in various experiments that random start and the most confusing target attack effectively prevent the label leaking and gradient masking problem. Coupled with the adversarial label part, embodiments of presented models significantly improve the state-of-the-art results. Experiments on one or more computationally challenging dataset also demonstrate the effectiveness of the presented BAT method embodiments.