Rob-GAN: Generator, Discriminator, and Adversarial Attacker
This work addresses the challenge of simultaneously improving GAN performance and adversarial robustness for deep learning practitioners, representing an incremental advancement by combining existing concepts.
The paper tackles the problem of improving both generative adversarial network (GAN) training and adversarial robustness by integrating adversarial attacks into GAN training, resulting in a framework that enhances convergence speed, image quality, and classifier robustness, with the classifier outperforming state-of-the-art adversarial training and the generator surpassing SN-GAN on ImageNet-143.
We study two important concepts in adversarial deep learning---adversarial training and generative adversarial network (GAN). Adversarial training is the technique used to improve the robustness of discriminator by combining adversarial attacker and discriminator in the training phase. GAN is commonly used for image generation by jointly optimizing discriminator and generator. We show these two concepts are indeed closely related and can be used to strengthen each other---adding a generator to the adversarial training procedure can improve the robustness of discriminators, and adding an adversarial attack to GAN training can improve the convergence speed and lead to better generators. Combining these two insights, we develop a framework called Rob-GAN to jointly optimize generator and discriminator in the presence of adversarial attacks---the generator generates fake images to fool discriminator; the adversarial attacker perturbs real images to fool the discriminator, and the discriminator wants to minimize loss under fake and adversarial images. Through this end-to-end training procedure, we are able to simultaneously improve the convergence speed of GAN training, the quality of synthetic images, and the robustness of discriminator under strong adversarial attacks. Experimental results demonstrate that the obtained classifier is more robust than the state-of-the-art adversarial training approach, and the generator outperforms SN-GAN on ImageNet-143.