Generating Less Certain Adversarial Examples Improves Robust
  Generalization
Minxing Zhang Michael Backes Xiao Zhang
Recent studies have shown that deep neural networks are vulnerable to
adversarial examples. Numerous defenses have been proposed to improve model
robustness, among which adversarial training is most successful. In this work,
we revisit the robust overfitting phenomenon. In particular, we argue that
overconfident models produced during adversarial training could be a potential
cause, supported by the empirical observation that the predicted labels of
adversarial examples generated by models with better robust generalization
ability tend to have significantly more even distributions. Based on the
proposed definition of adversarial certainty, we incorporate an extragradient
step in the adversarial training framework to search for models that can
generate adversarially perturbed inputs with lower certainty, further improving
robust generalization. Our approach is general and can be easily combined with
other variants of adversarial training methods. Extensive experiments on image
benchmarks demonstrate that our method effectively alleviates robust
overfitting and is able to produce models with consistently improved
robustness.