Deep Neural Networks (DNNs) are being used to solve a wide range of problems in many domains including safety-critical domains like self-driving cars and medical imagery. DNNs suffer from vulnerability against adversarial attacks. In the past few years, numerous approaches have been proposed to tackle this problem by training networks using adversarial training. Almost all the approaches generate adversarial examples for the entire training dataset, thus increasing the training time drastically. We show that we can decrease the training time for any adversarial training algorithm by using only a subset of training data for adversarial training. To select the subset, we filter the adversarially-prone samples from the training data. We perform a simple adversarial attack on all training examples to filter this subset. In this attack, we add a small perturbation to each pixel and a few grid lines to the input image. We perform adversarial training on the adversarially-prone subset and mix it with vanilla training performed on the entire dataset. Our results show that when our method-agnostic approach is plugged into FGSM, we achieve a speedup of 3.52x on MNIST and 1.98x on the CIFAR-10 dataset with comparable robust accuracy. We also test our approach on state-of-the-art Free adversarial training and achieve a speedup of 1.2x in training time with a marginal drop in robust accuracy on the ImageNet dataset.

翻译：深度神经网络（DNN）正被用于解决多个领域的广泛问题，包括自动驾驶和医学影像等安全关键领域。然而，DNN存在对抗攻击的脆弱性。过去几年中，研究者提出了多种通过对抗训练来应对该问题的方法。几乎所有方法都会针对整个训练数据集生成对抗样本，从而显著增加训练时间。我们证明，通过仅使用训练数据子集进行对抗训练，可以降低任何对抗训练算法的训练时间。为选择该子集，我们从训练数据中筛选出易受对抗攻击的样本。具体而言，我们对所有训练样本执行一次简单的对抗攻击以筛选子集：对输入图像的每个像素添加微小扰动，并叠加若干网格线。随后，我们在该易受攻击子集上进行对抗训练，并将其与在全数据集上执行的常规训练混合。实验结果表明，当我们将这种与具体方法无关的技术嵌入FGSM时，在MNIST和CIFAR-10数据集上分别实现了3.52倍和1.98倍的加速比，且鲁棒准确率相当。此外，我们将该方法应用于最先进的自由对抗训练（Free adversarial training），在ImageNet数据集上训练时间加速1.2倍，鲁棒准确率仅有微小下降。