Introduction

Adversarial training, i.e., training on adversarial examples generated on-the-fly, has been shown to suffer from server overfitting. This means that robustness on test examples does not continuously decrease throughout training. As result, early stopping needs to be applied to obtain state-of-the-art adversarial robustness. Recently, it was argued that robust overfitting can be avoided by encouraging flat minima in the (robust) loss landscape with respect to weight perturbations. My ICCV'21 paper empirically confirms this hypothesis by showing that flatness consistently improves adversarial robustness.

The code corresponding to the paper is now available on GitHub:

The corresponding paper is available on ArXiv; also check out the project page:

@article{Stutz2021ICCV,
    author    = {David Stutz and Matthias Hein and Bernt Schiele},
    title     = {Relating Adversarially Robust Generalization to Flat Minima},
    booktitle = {IEEE International Conference on Computer Vision (ICCV)},
    publisher = {IEEE Computer Society},
    year      = {2021}
}