Regularizing Neural Networks via Adversarial Model Perturbation

CVPR 2021  ·  Yaowei Zheng, Richong Zhang, Yongyi Mao ·

Effective regularization techniques are highly desired in deep learning for alleviating overfitting and improving generalization. This work proposes a new regularization scheme, based on the understanding that the flat local minima of the empirical risk cause the model to generalize better. This scheme is referred to as adversarial model perturbation (AMP), where instead of directly minimizing the empirical risk, an alternative "AMP loss" is minimized via SGD. Specifically, the AMP loss is obtained from the empirical risk by applying the "worst" norm-bounded perturbation on each point in the parameter space. Comparing with most existing regularization schemes, AMP has strong theoretical justifications, in that minimizing the AMP loss can be shown theoretically to favour flat local minima of the empirical risk. Extensive experiments on various modern deep architectures establish AMP as a new state of the art among regularization schemes. Our code is available at

PDF Abstract CVPR 2021 PDF CVPR 2021 Abstract

Results from the Paper

Task Dataset Model Metric Name Metric Value Global Rank Uses Extra
Training Data
Image Classification CIFAR-10 PyramidNet + AA (AMP) Percentage correct 98.02 # 50
PARAMS 27.22M # 218
Image Classification CIFAR-10 PreActResNet18 (AMP) Percentage correct 96.03 # 113
Image Classification CIFAR-100 PreActResNet18 (AMP) Percentage correct 78.49 # 131
Image Classification CIFAR-100 PyramidNet + AA (AMP) Percentage correct 86.64 # 52
Image Classification SVHN PyramidNet + AA (AMP) Percentage error 1.35 # 8
Image Classification SVHN PreActResNet18 (AMP) Percentage error 2.30 # 33