This paper proposes a new loss function for adversarial training. Since
adversarial training has difficulties, e.g., necessity of high model capacity,
focusing on important data points by weighting cross-entropy loss has attracted
much attention. However, they are vulnerable to sophisticated attacks, e.g.,
Auto-Attack. This paper experimentally reveals that the cause of their
vulnerability is their small margins between logits for the true label and the
other labels. Since neural networks classify the data points based on the
logits, logit margins should be large enough to avoid flipping the largest
logit by the attacks. Importance-aware methods do not increase logit margins of
important samples but decrease those of less-important samples compared with
cross-entropy loss. To increase logit margins of important samples, we propose
switching one-vs-the-rest loss (SOVR), which switches from cross-entropy to
one-vs-the-rest loss for important samples that have small logit margins. We
prove that one-vs-the-rest loss increases logit margins two times larger than
the weighted cross-entropy loss for a simple problem. We experimentally confirm
that SOVR increases logit margins of important samples unlike existing methods
and achieves better robustness against Auto-Attack than importance-aware
methods.