You Only Propagate Once: Accelerating Adversarial Training via Maximal Principle

Deep learning achieves state-of-the-art results in many tasks in computer\nvision and natural language processing. However, recent works have shown that\ndeep networks can be vulnerable to adversarial perturbations, which raised a\nserious robustness issue of deep networks. Adversarial training, typically\nformulated as a robust optimization problem, is an effective way of improving\nthe robustness of deep networks. A major drawback of existing adversarial\ntraining algorithms is the computational overhead of the generation of\nadversarial examples, typically far greater than that of the network training.\nThis leads to the unbearable overall computational cost of adversarial\ntraining. In this paper, we show that adversarial training can be cast as a\ndiscrete time differential game. Through analyzing the Pontryagin's Maximal\nPrinciple (PMP) of the problem, we observe that the adversary update is only\ncoupled with the parameters of the first layer of the network. This inspires us\nto restrict most of the forward and back propagation within the first layer of\nthe network during adversary updates. This effectively reduces the total number\nof full forward and backward propagation to only one for each group of\nadversary updates. Therefore, we refer to this algorithm YOPO (You Only\nPropagate Once). Numerical experiments demonstrate that YOPO can achieve\ncomparable defense accuracy with approximately 1/5 ~ 1/4 GPU time of the\nprojected gradient descent (PGD) algorithm. Our codes are available at\nhttps://https://github.com/a1600012888/YOPO-You-Only-Propagate-Once.\n