Semi-supervised robust training with generalized perturbed neighborhood

Highlights：

• We propose a robust training method by jointly minimizing standard risk and robust risk, which is naturally extended the semi-supervised mode.

• By generalizing the definition of the perturbed neighborhood to cover different types of perturbations, our method achieves the joint robustness to different perturbations, such as the pixel-wise and spatial perturbation.

• Experiments on benchmark datasets verify the superiority of the proposed SRT method to state-of-the-art adversarial training methods, as well as the robustness of SRT to pixel-wise and spatial perturbations simultaneously.