Adversarial Training (AT) plays an important role in defending against adversarial attacks, which has become a powerful means to improve the robustness of deep learning models in secure and critical applications. It can be formalized as a min-max optimization problem. At present, the existing adversarial training approaches often use \(l_{1}\) , \(l_{2}\) and \(l_{\infty }\) norms to constrain the perturbations. However, we find that deep learning models are highly sensitive to \(l_{\infty }\) perturbations. In order to improve the defence of the model against \(l_{\infty }\) perturbations, this paper introduces \(l_p\) \((0<p<1)\) norm into adversarial training, and proposes \(l_p\) norm-based multi steepest descent algorithm ( \(l_p\) -MSD). Through experiments we find that \(l_p\) -MSD algorithm works best when p is equal to 1/2. Furthermore, experimental results show that the robustness of the model is improved by 10.34% and 10.93% compared to traditional multi steepest descent algorithm. Finally, we carry out a perturbation selection experiment to explore the contribution of the \(l_{1/2}\) norm during the training.
