Adversarial Training Can Hurt Generalization
This addresses a fundamental tradeoff between robustness and generalization in machine learning, with implications for adversarial defense strategies, though it is incremental as it builds on prior work on accuracy tradeoffs.
The paper demonstrates that adversarial training can harm generalization even when an optimal predictor with infinite data performs well on both standard and robust accuracy, using a convex learning problem to isolate this tension, and shows that robust self-training mitigates the tradeoff by using unlabeled data.
While adversarial training can improve robust accuracy (against an adversary), it sometimes hurts standard accuracy (when there is no adversary). Previous work has studied this tradeoff between standard and robust accuracy, but only in the setting where no predictor performs well on both objectives in the infinite data limit. In this paper, we show that even when the optimal predictor with infinite data performs well on both objectives, a tradeoff can still manifest itself with finite data. Furthermore, since our construction is based on a convex learning problem, we rule out optimization concerns, thus laying bare a fundamental tension between robustness and generalization. Finally, we show that robust self-training mostly eliminates this tradeoff by leveraging unlabeled data.