  Adversarial training (AT) is a widely recognized defense mechanism to gain
the robustness of deep neural networks against adversarial attacks. It is built
on min-max optimization (MMO), where the minimizer (i.e., defender) seeks a
robust model to minimize the worst-case training loss in the presence of
adversarial examples crafted by the maximizer (i.e., attacker). However, the
conventional MMO method makes AT hard to scale. Thus, Fast-AT (Wong et al.,
2020) and other recent algorithms attempt to simplify MMO by replacing its
maximization step with the single gradient sign-based attack generation step.
Although easy to implement, Fast-AT lacks theoretical guarantees, and its
empirical performance is unsatisfactory due to the issue of robust catastrophic
overfitting when training with strong adversaries. In this paper, we advance
Fast-AT from the fresh perspective of bi-level optimization (BLO). We first
show that the commonly-used Fast-AT is equivalent to using a stochastic
gradient algorithm to solve a linearized BLO problem involving a sign
operation. However, the discrete nature of the sign operation makes it
difficult to understand the algorithm performance. Inspired by BLO, we design
and analyze a new set of robust training algorithms termed Fast Bi-level AT
(Fast-BAT), which effectively defends sign-based projected gradient descent
(PGD) attacks without using any gradient sign method or explicit robust
regularization. In practice, we show our method yields substantial robustness
improvements over baselines across multiple models and datasets. Codes are
available at https://github.com/OPTML-Group/Fast-BAT.
