On the Duality Between Sharpness-Aware Minimization and Adversarial Training

TL;DR

This paper investigates the duality between Sharpness-Aware Minimization (SAM) and Adversarial Training (AT) for robustness. By combining empirical evidence with a theoretical model, it shows that SAM can enhance adversarial robustness without sacrificing clean accuracy, and it analyzes how weight perturbations steer learning toward robust features. The authors derive a robust-feature weight framework in a simple binary model, showing SAM and AT both increase reliance on robust features but via different perturbation mechanisms and strengths. Extensive experiments across image classification, semantic segmentation, and text classification demonstrate SAM’s broad robustness gains, its competitiveness with AT, and the potential of using SAM as a lightweight substitute when accuracy on clean data is critical.

Abstract

Adversarial Training (AT), which adversarially perturb the input samples during training, has been acknowledged as one of the most effective defenses against adversarial attacks, yet suffers from inevitably decreased clean accuracy. Instead of perturbing the samples, Sharpness-Aware Minimization (SAM) perturbs the model weights during training to find a more flat loss landscape and improve generalization. However, as SAM is designed for better clean accuracy, its effectiveness in enhancing adversarial robustness remains unexplored. In this work, considering the duality between SAM and AT, we investigate the adversarial robustness derived from SAM. Intriguingly, we find that using SAM alone can improve adversarial robustness. To understand this unexpected property of SAM, we first provide empirical and theoretical insights into how SAM can implicitly learn more robust features, and conduct comprehensive experiments to show that SAM can improve adversarial robustness notably without sacrificing any clean accuracy, shedding light on the potential of SAM to be a substitute for AT when accuracy comes at a higher priority. Code is available at https://github.com/weizeming/SAM_AT.

Theorems & Definitions (11)

• Theorem 4.1
• Theorem 4.2: Standard training
• Theorem 4.3: Adversarial training
• Theorem 4.4: Sharpness-aware minimization
• Theorem 4.5
• Theorem 4.6
• proof
• proof
• proof
• proof