Catastrophic Overfitting, Entropy Gap and Participation Ratio: A Noiseless $l^p$ Norm Solution for Fast Adversarial Training

TL;DR

This work addresses catastrophic overfitting in fast adversarial training by linking CO to gradient concentration and introducing a norm-adaptive framework. It reformulates adversarial perturbations as fixed-point problems under $l^p$ constraints, deriving the $l^p$-FGSM method that smoothly transitions from $l^2$ to $l^ty$ regimes. By introducing gradient-concentration metrics $PR_1$ and entropy gap and a practical threshold for adapting $p$, the authors provide a principled, computation-efficient way to mitigate CO without noise or extra regularization. Empirical results on CIFAR-10/100, SVHN, and ImageNet demonstrate competitive robustness and scalability, highlighting the potential to deploy fast, robust training in safety-critical settings through norm-adaptive adversarial learning.$

Abstract

Adversarial training is a cornerstone of robust deep learning, but fast methods like the Fast Gradient Sign Method (FGSM) often suffer from Catastrophic Overfitting (CO), where models become robust to single-step attacks but fail against multi-step variants. While existing solutions rely on noise injection, regularization, or gradient clipping, we propose a novel solution that purely controls the $l^p$ training norm to mitigate CO. Our study is motivated by the empirical observation that CO is more prevalent under the $l^{\infty}$ norm than the $l^2$ norm. Leveraging this insight, we develop a framework for generalized $l^p$ attack as a fixed point problem and craft $l^p$-FGSM attacks to understand the transition mechanics from $l^2$ to $l^{\infty}$. This leads to our core insight: CO emerges when highly concentrated gradients where information localizes in few dimensions interact with aggressive norm constraints. By quantifying gradient concentration through Participation Ratio and entropy measures, we develop an adaptive $l^p$-FGSM that automatically tunes the training norm based on gradient information. Extensive experiments demonstrate that this approach achieves strong robustness without requiring additional regularization or noise injection, providing a novel and theoretically-principled pathway to mitigate the CO problem.

Figures (13)

• Figure 1: CO phenomena on CIFAR-10 krizhevsky2009learning using WideResNet-28-10 zagoruyko2016wide: Upper:$l^{\infty}$ training ($\epsilon = 8/255$) shows accuracy collapse against PGD-50 ($\epsilon = 8/255$) madry2017towards attacks, while $l^2$ ($\epsilon = 32/255$, both training and attack) remains stable. Lower: CO onset in $l^{\infty}$ training correlates with gradient norm increase, absent in $l^2$ training (norms normalized at epoch 1).
• Figure 2: Impact of $l^p$ norm choice on training dynamics and robustness for CIFAR-10 with WideResNet-28-10. The choice of $p$ reveals a key trade-off: higher values ($p \geq 32$) initially show better robustness but become vulnerable to Catastrophic Overfitting (CO), evident in the $l^\infty$ PGD-50 plot (second left). Lower $p$ values prevent CO but with reduced adversarial robustness. Notably, $l^2$ PGD-50 accuracy (rightmost) remains stable across different $p$ values, suggesting $l^2$ robustness is less sensitive to norm choice. Results shown for $\epsilon = 8/255$ over 30 epochs.
• Figure 3: Depiction of training effect on CIFAR-10's loss landscape at different training point. The upper panels display the landscape after one epoch and the lower ones ten epochs with $l^p$-FGSM (Alg.\ref{['alg:lp-fgsm']}). Training points are positioned at $(0,0)$, $\varepsilon_1$ and $\varepsilon_2$ are eigenvectors corresponding to the Hessian's ($\nabla^{2}_x \ell$) extreme eigenvalues for each sample. Training induces local convexity.
• Figure 4: Illustration of the initial two ascents of the fixed-point algorithm (\ref{['eq:fx2']}) for optimal perturbation identification under the $l^2$ constraint.
• Figure 5: Variation of the $l^p$ transition function $\Upsilon_p$ for different values of $p$. The high-pass filtering effect mirrors the thresholding behavior in ZeroGrad golgooni2021zerograd.

Theorems & Definitions (3)

• Lemma 4.1: Noise-Induced Alignment
• Lemma 5.1: Restated
• Proposition 6.1