Adversarial training via multi-guidance and historical memory enhancement

Deep neural networks (DNNs) are often susceptible to the influence of adversarial examples, potentially leading to severe security issues. Adversarial training stands out as one of the most effective defenses. In this paper, we empirically demonstrate that weakly robust models maintain resilience to adversarial examples generated on a fully trained robust model. Building on this observation, we introduce a novel weight ensemble training method named Multi-Guided Adversarial Training (MGAT). MGAT improves both clean and adversarial accuracy through two guiding strategies: self-guidance and expert-guidance. Self-guidance promotes diversity in decision boundaries among member models, while expert-guidance aligns them more closely with natural decision boundaries. Additionally, MGAT enhances the historical memory of model weights using an exponential moving average (EMA) with a memory factor, thereby better memorizing the weights of weakly robust models. Our experiments demonstrate that MGAT is highly effective in defending against a range of adversarial attacks. Notably, MGAT achieves an accuracy of 55.48% against AutoAttack, marking a 10.92% improvement over standard adversarial training on CIFAR-10.