Adversarial Training with Domain Generalization

Adversarial training (AT) with a self-adversarial pattern is one of the most effective means to enhance model’s robustness. Domain generalization (DG) is capable of addressing the issue that models trained in the source domain appear to underperform when applied to the target domain by reducing the domain distribution variance. This means that the model trained with DG can generalize well to the out-of-distribution (OOD) datasets, which coincides with the goal of AT. Therefore, we view natural images and their adversarial images as two domains (i.e., natural domain and adversarial domain), and hope that using the DG to bridge the probability distributions gap between the two domains. Respecting this, we propose a DG-guided AT method (AT-DG). Specifically, in the process of learning the domain labels of the images, we leverage contrastive learning to achieve feature alignment between the two domains to learn the cross-domain invariant features of the data, and to enhance the adversarial robustness. Experimental results demonstrate that our approach effectively improves the robustness and generalization against various adversarial attacks.