Seasoning Model Soups for Robustness to Adversarial and Natural Distribution Shifts
This work addresses the challenge of making machine learning models robust to diverse adversarial attacks and distribution shifts, which is crucial for real-world deployment, but it is incremental as it builds on existing model soup methods.
The paper tackles the problem of training classifiers robust to multiple adversarial threats and unseen distribution shifts by proposing adversarially-robust model soups, which are linear combinations of parameters that trade off robustness to different ℓp-norm bounded adversaries. The result shows that these soups can achieve robustness to all threats without joint training, sometimes outperforming specialized models, and adapt to distribution shifts from few examples.
Adversarial training is widely used to make classifiers robust to a specific threat or adversary, such as $\ell_p$-norm bounded perturbations of a given $p$-norm. However, existing methods for training classifiers robust to multiple threats require knowledge of all attacks during training and remain vulnerable to unseen distribution shifts. In this work, we describe how to obtain adversarially-robust model soups (i.e., linear combinations of parameters) that smoothly trade-off robustness to different $\ell_p$-norm bounded adversaries. We demonstrate that such soups allow us to control the type and level of robustness, and can achieve robustness to all threats without jointly training on all of them. In some cases, the resulting model soups are more robust to a given $\ell_p$-norm adversary than the constituent model specialized against that same adversary. Finally, we show that adversarially-robust model soups can be a viable tool to adapt to distribution shifts from a few examples.