Technical Summary: Taming the Long Tail: Rebalancing Adversarial Training via Adaptive Perturbation

Problem Statement

Deep neural networks (DNNs) are highly vulnerable to adversarial examples, where imperceptible perturbations significantly degrade model performance. While adversarial training (AT) has become the primary defense strategy, existing research predominantly evaluates performance on balanced datasets (e.g., CIFAR-10/100), overlooking the challenges posed by real-world long-tail data distributions. In long-tail scenarios, a small number of "head" classes dominate, while the majority of "tail" classes are underrepresented.

Models trained on long-tail datasets typically exhibit overconfidence in head classes, leading to poor generalization on tail classes. In adversarial settings, this issue is exacerbated because attackers are not constrained by class frequencies and can deliberately target tail classes. Existing methods for long-tail adversarial training (e.g., combining AT with Balanced Softmax Loss) often fail to address the critical interdependency between model updates and adversarial example generation. Overconfident models bias the adversarial examples they generate, which in turn exacerbates the class imbalance, creating a feedback loop that undermines robustness.

The core problem addressed is how to simultaneously mitigate adversarial vulnerability and class imbalance in long-tail distributions, a challenge that traditional adversarial training methods struggle with due to skewed training objectives and unstable evolution of adversarial distributions.

Methodology: RobustLT

The authors propose RobustLT, a plug-and-play framework designed to adaptively adjust perturbations during adversarial training. The method is grounded in theoretical insights suggesting that perturbations can simultaneously address model vulnerability and data imbalance. RobustLT consists of two key components:

1. Class-wise Perturbation Balancing (CPB)

CPB addresses the skewed training objective caused by class imbalance. Theoretically, the authors demonstrate that assigning well-designed perturbation intensities to each class can rebalance the training objective.

• Mechanism: CPB assigns a higher perturbation intensity to minority (tail) classes and a lower intensity to majority (head) classes.
• Formula: The perturbation intensity $\epsilon_{y_i}$ for class $y_i$ is defined as:
  $$\epsilon_{y_i} = (1 - \alpha)\epsilon + \tau \sqrt{\log K_{y_i}} \epsilon$$
  where $\epsilon$ is the base intensity, $K_{y_i}$ is the class-wise imbalance ratio relative to the most frequent class, and $\alpha, \tau$ are hyperparameters controlling the base level and slope. The method ensures the expected perturbation magnitude remains bounded.
• Goal: This adaptive intensity shifts the decision boundary to mitigate overconfidence, effectively restoring a balanced training objective.

2. Adversarial Iteration Weighting (AIW)

AIW addresses the unstable evolution of adversarial distributions. Theoretical analysis reveals that large shifts in the adversarial distribution between training iterations (quantified by Wasserstein distance) degrade robustness.

• Mechanism: AIW introduces an adaptive weight that gradually increases the perturbation intensity from 0 to the target $\epsilon_{y_i}$ over the first $\beta T$ iterations (where $T$ is the total number of iterations).
• Formula:
  $$\epsilon^{(t)}_{y} = \min\left\{ \frac{t-1}{\beta T}, 1 \right\} \cdot \epsilon_{y}$$
• Goal: By controlling the perturbation intensity in the early stages of training, AIW stabilizes the evolution of adversarial distributions, ensuring that the distribution of adversarial examples generated at iteration $t$ remains close to that of iteration $t-1$.

Theoretical Insights

The paper provides a theoretical foundation for these methods through an online optimization perspective and a conceptual binary classification task involving robust and non-robust features:

1. Limitations of Traditional AT: Traditional methods fail on long-tail data because they minimize a skewed objective (leading to uneven robustness across classes) and allow unstable distribution shifts between iterations.
2. Feasibility of Dual Optimization: The authors prove that there exists a non-empty intersection between the feasible perturbation intensities required for adversarial robustness (relying on robust features) and class balance (eliminating bias in the decision boundary).
3. Guidance for Perturbation: The theory suggests that a higher perturbation intensity should be allocated to the minority class compared to the majority class, with the difference proportional to $\sqrt{\log K}$, where $K$ is the imbalance ratio.

Experimental Results

The authors evaluated RobustLT on long-tailed versions of CIFAR-10, CIFAR-100, and TinyImageNet using various base adversarial training algorithms (AT, AWP, RoBal, REAT, AT-BSL, TAET).

• Performance: RobustLT consistently improves both natural accuracy and adversarial robustness compared to baseline methods.
• Tail Class Improvement: The most significant gains are observed in the tail classes. For instance, on CIFAR-10-LT with the AT-BSL base, RobustLT improved tail robust accuracy from 28.60% to 35.98%.
• Robustness to Attacks: The method demonstrates consistent improvements against various attack strategies, including PGD, CW, and AutoAttack.
• Ablation Studies: Sensitivity analysis confirms that both CPB (controlled by $\alpha$) and AIW (controlled by $\beta$) are necessary. CPB offsets the objective skew, while AIW stabilizes distribution evolution. The combination yields a better trade-off between natural and robust accuracy than either component alone.

Significance and Claims

The paper claims that RobustLT offers a significant advancement in the field of adversarial robustness for real-world applications by:

1. Challenging Assumptions: It challenges the assumption that adversarial data inherently inherits the same class imbalance as clean data, showing that perturbations can be used to rebalance the distribution.
2. Theoretical Unification: It provides the first theoretical proof that adversarial perturbations can simultaneously address model vulnerability and data imbalance, deriving specific guidelines for adaptive perturbation intensity.
3. Practical Utility: As a plug-and-play framework, RobustLT is compatible with various existing adversarial training algorithms, making it a practical solution for improving robustness in long-tail scenarios without requiring fundamental changes to existing training pipelines.

The authors conclude that by adaptively adjusting perturbations via class-wise and iteration-wise control, RobustLT effectively mitigates the overconfidence induced by long-tailed data, striking a superior trade-off between adversarial robustness and class balance.