This repository contains code to reproduce results from the paper:

Improving the Generalization of Adversarial Training with Domain Adaptation （ICLR 2019）

openreview report: https://openreview.net/forum?id=SyfIfnC5Ym

The code was tested with Python 3.6.5, Tensorflow 1.8.0, Keras 2.1.2, Keras_contrib 0.0.2, Torchvision 0.2.1 and Numpy 1.14.3.

We use Adversarial Training (on FGSM) with Domain Adaptaion to train a main model (modelZ) for CIFAR-10 (default).

python -m train_atda models/modelZ_atda --type=0

In addition, we use Adversarial Training (on the noisy PGD) with Domain Adaptaion to train a main model (modelZ) for CIFAR-10 (default).

python -m train_atda_npgd models/modelZ_atda --type=0

Then, we use Normal Training to train a model (modelC) for CIFAR-10 (default).

python -m train models/modelC --type=3

To use Original/ Standard Adversarial Training to train a main model：

python -m train_adv models/modelZ_adv --type=0

To use Ensemble Adversarial Training to train a main model：

# First train pre-trained models:
python -m train models/modelA --type=1
python -m train models/modelB --type=2
# use Ensemble Adversarial Training method to train with pre-trained models
python -m train_adv models/modelZ_ens models/modelA models/modelB --type=0

The accuracy of the models on the Fashion MNIST test set can be computed using:

python -m simple_eval test [model(s)]

To evaluate robustness to various attacks, we use:

python -m simple_eval [attack] [source_model] [target_model(s)] [--parameters (opt)]

The attack can be:

Code refer heavily to: Ensemble Adversarial Training