FST: Improving Adversarial Robustness Via Feature Similarity-based Targeted Adversarial Training

Deep learning models have been found to be vulnerable to adversarial noise. Adversarial training is a major defense strategy to mitigate the interference caused by adversarial noise. However, the correlations between different categories on deep features in the model have not been fully considered in adversarial training. Our multi-perspective investigations indicate that adversarial noise can disrupt this correlation, resulting in undesirable close inter-class feature distances and far intra-class feature distances, thus degrading accuracy. To solve this problem, in this work, we propose a Feature Similarity-based Targeted adversarial training (FST), which guides the model to learn an appropriate feature distribution among categories under the adversarial environment for making rational decisions. Specifically, we first design a Feature Obfuscation Attack to obfuscate the natural state of feature similarity among categories, and then it is leveraged to generate specific adversarial training examples. Next, we construct target feature similarity matrices as supervision information to prompt the model to learn clean deep features for adversarial data and thereby achieve accurate classification. The target matrix is initialized based on the features learned from natural examples by a naturally pre-trained model. To further enhance the feature similarity between examples with the same category, we directly assign the highest similarity value to the region with the same category in the target matrix. Experimental results on popular datasets show the superior performance of our method, and ablation studies are conducted to demonstrate the effectiveness of designed modules.