Search papers, labs, and topics across Lattice.
This paper interprets catastrophic overfitting (CO) in Fast Adversarial Training (FAT) as a backdoor phenomenon, where models learn weak triggers specific to the training attack. They show that CO exhibits characteristics of backdoor attacks, including pathway division, diverse feature predictions, and universal class distinguishable triggers. Based on this interpretation, they propose and validate backdoor-inspired mitigation strategies, including parameter recalibration and weight outlier suppression, to improve generalization.
Catastrophic overfitting in fast adversarial training isn't just overfitting – it's a backdoor, and now we can use backdoor defenses to fix it.
Fast Adversarial Training (FAT) has attracted significant attention due to its efficiency in enhancing neural network robustness against adversarial attacks. However, FAT is prone to catastrophic overfitting (CO), wherein models overfit to the specific attack used during training and fail to generalize to others. While existing methods introduce diverse hypotheses and propose various strategies to mitigate CO, a systematic and intuitive explanation of CO remains absent. In this work, we innovatively interpret CO through the lens of backdoor. Through validations on pathway division, diverse feature predictions, and universal class distinguishable triggers in CO, we conceptualize CO as a weak trigger variant of unlearnable tasks, unifying CO, backdoor attacks, and unlearnable tasks under a common theoretical framework. Guided by this, we leverage several backdoor inspired strategies to mitigate CO: (i) Recalibrate CO affected model parameters using vanilla fine tuning, linear probing, or reinitialization-based techniques; (ii) Introduce a weight outlier suppression constraint to regulate abnormal deviations in model weights. Extensive experiments support our interpretation of CO and show the efficacy of the proposed mitigation strategies.
