Training more secure neural networks by using local linearity regularization

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for training a neural network. One of the methods includes processing each training input using the neural network and in accordance with the current values of the network parameters to generate a network output for the training input; computing a respective loss for each of the training inputs by evaluating a loss function; identifying, from a plurality of possible perturbations, a maximally non-linear perturbation; and determining an update to the current values of the parameters of the neural network by performing an iteration of a neural network training procedure to decrease the respective losses for the training inputs and to decrease the non-linearity of the loss function for the identified maximally non-linear perturbation.

BACKGROUND

This specification relates to training neural networks that are secure, i.e., that are robust to attacks from malicious actors.

SUMMARY

This specification describes a system implemented as computer programs on one or more computers in one or more locations that trains a neural network to be resistant to adversarial attacks.

According to an aspect, there is provided a method of training a neural network having a plurality of network parameters, in particular to provide a more secure neural network (a method of increasing the security of the neural network). The method may comprise obtaining a plurality of training inputs and for each of the plurality of training inputs, a respective target output for the training input. The method may further comprise training the neural network on each of the plurality of training inputs. The training may comprise processing each of the training inputs using the neural network and in accordance with current values of the network parameters to generate a respective network output for each of the training inputs. The training may further comprise computing a respective loss for each of the training inputs by evaluating a loss function. The loss function may measure a difference between (i) an output generated by the neural network by processing an input in an input-output pair and (ii) an output in the input-output pair. Computing the loss for each of the training inputs may comprise evaluating the loss function at the input-output pair that includes the training input and the target output for the training input. The training may further comprise identifying, from a plurality of possible perturbations, a maximally non-linear perturbation. The maximally non-linear perturbation may be a perturbation for which the loss function is most non-linear when evaluated at an input-output pair that includes (i) a perturbed training input generated by applying the possible perturbation to a given training input and (ii) a target output for the given training input. The training may further comprise determining an update to the current values of the parameters of the neural network by performing an iteration of a neural network training procedure to decrease the respective losses for the training inputs and to decrease the non-linearity of the loss function for the identified maximally non-linear perturbation.

The method may comprise the following features. The training inputs may be images. Identifying the maximally non-linear perturbation may comprise initializing a perturbation.

The identification may further comprise, for each of one or more iterations, the following features (in isolation or in combination): for each of the training inputs, generating a respective perturbed training input by applying the perturbation to the training input. For each of the training inputs, processing the perturbed training input using the neural network and in accordance with the current values of the network parameters to generate a network output for the perturbed training input. For each of the training inputs, determining, using the network output for the perturbed training input, a gradient of a local linearity measure with respect to the perturbation and evaluated at the perturbed input for the training input. The local linearity measure may measure how non-linear the loss function is when evaluated at an input-output pair that includes (i) the perturbed training input and (ii) the target output for the training input. The identification may further comprise generating an averaged gradient of the local linearity measure by averaging the gradients for the training inputs. The identification may further comprise updating the perturbation using the averaged gradient. The identification may further comprise selecting the perturbation after the last iteration of the one or more iterations as the maximally non-linear perturbation.

The local linearity measure may be an absolute difference between (1) the loss function evaluated at the input-output pair that includes (i) the perturbed training input and (ii) the target output for the training input and (2) a first-order Taylor expansion of the loss function evaluated at the input-output pair. Determining the update to the current values of the parameters of the neural network may comprise: performing the iteration of the neural network training procedure to minimize a local linearity regularized loss function that measures at least the respective losses for the plurality of training inputs and the non-linearity for the identified maximally non-linear perturbation.

Performing the iteration of the neural network training procedure may comprise: determining a respective gradient with respect to the network parameters of the local linearity regularized loss function for each of the plurality of training examples. The performing may further comprise determining an averaged gradient with respect to the network parameters from the respective gradients for the plurality of training examples. The performing may further comprise determining an update to the current values of the network parameters from the averaged gradient. The performing may further comprise generating updated values of the network parameters by applying the update to the current values of the network parameters.

The local linearity regularized loss function may include a first term that measures an average loss for the plurality of training examples. The local linearity regularized loss function may include a second term that measures an average across the plurality of training inputs of an absolute difference between (i) the loss function evaluated at an input-output pair that includes 1) the training input perturbed with the maximally non-linear perturbation and 2) the target output for the training input and (ii) a first-order Taylor expansion of the loss function evaluated at the input-output pair that includes 1) the training input perturbed with the maximally non-linear perturbation and 2) the target output for the training input. The local linearity regularized loss function may include a third term that measures an average across the plurality of training inputs of an absolute value of a dot product between the maximally non-linear perturbation and a gradient with respect to the training input of the loss function evaluated at the input-output pair that includes the training input and the target output for the training input.

The method may be used to adapt an existing neural network to improve the neural network's security.

According to another aspect, there is provided a system comprising one or more computers and one or more storage devices storing instructions that when executed by the one or more computers cause the one or more computers to perform the operations of the above method aspect.

According to a further aspect, there is provided one or more computer storage media storing instructions that when executed by one or more computers cause the one or more computers to perform the operations of the above method aspect.

It will be appreciated that features described in the context of one aspect may be combined with features of another aspect.

By training a neural network as described in this specification, the neural network becomes more secure than neural networks trained using conventional approaches, i.e., because the trained neural network becomes less susceptible to adversarial attacks than the neural networks that are trained using conventional approaches. An adversarial attack occurs when a malicious attacker intentionally submits inputs to the neural network in an attempt to cause undesired behavior, i.e., to cause incorrect outputs to be generated by the neural network. For example, an attacker may submit inputs to an image classification neural network that appear to the human eye to be of one object category but that have been slightly perturbed in an attempt to cause the neural network to misclassify the inputs. Thus, because the system becomes more resistant to these types of attacks, the security of the computer system that includes the neural network is improved.

In one example, the system may be a biometric authentication system. The neural network may be configured to recognize facial images, fingerprints, voice patterns or other types of biometric data. An adversarial attack may attempt to cause the neural network to misclassify input biometric data. In another example, the system may be a network security system. The neural network may be configured to detect malicious or suspicious data on the network. An adversarial attack may attempt to cause the neural network to fail to detect such data. In a further example, the system may be an autonomous vehicle or robotic system. The neural network may be configured to control its operation. An adversarial attack may take the form of a malicious signal or an alteration in the environment such as an altered road sign to attempt to cause the neural network to provide a different control output than would otherwise be expected.

Conventional techniques, e.g., adversarial training techniques, for training neural networks to be more resistant to adversarial attack significantly increase the computational resource consumption, e.g., processor cycles, and wall clock time consumed by the training process. This is particularly true when the neural network is complex, i.e., has a large amount of parameters, and the inputs to the network are high-dimensional, e.g., images with relatively high resolution, as is required for many industrial applications.

The described techniques, however, match or even exceed the performance of these conventional techniques while being much more computationally efficient, at least in part because identifying the maximally non-linear perturbation requires many fewer computationally intensive and time consuming gradient steps than is required to find a strong adversarial perturbation using existing techniques.

DETAILED DESCRIPTION

FIG.1shows an example neural network training system100. The neural network training system100is an example of a system implemented as computer programs on one or more computers in one or more locations, in which the systems, components, and techniques described below can be implemented.

The neural network training system100is a system that trains a neural network110on training data140to determine trained values of the parameters of the neural network (referred to as network parameters118).

The neural network110can be configured to receive any kind of digital data input as a network input and to generate any kind of network output, i.e., any kind of score, classification, or regression output based on the network input.

In particular, the described techniques can be used to train a neural network110to perform any task that requires receiving continuous inputs, i.e., inputs that can take any value from some predetermined range.

For example, if the inputs to the neural network are images or features that have been extracted from images, the output generated by the neural network for a given image may be an image classification output that includes scores for each of a set of object categories, with each score representing an estimated likelihood that the image contains an image of an object belonging to the category.

As another example, if the inputs to the neural network are images, the output generated by the neural network for a given image may be an objection detection output that identifies positions of objects within the given image.

As another example, if the inputs to the neural network are images, the output generated by the neural network for a given image may be an image segmentation output that identifies, for each pixel of the given input image, a category from a set of possible categories that the scene depicted at the pixel belongs to.

As another example, if the inputs to the neural network are sensor data characterizing a state of an environment being interacted with by an agent, e.g., image data, position data, or other sensor data captured by sensors of a robot or other agent, the output generated by the neural network data can be a control policy for controlling the agent, e.g., data defining a probability distribution over possible actions that can be performed by the agent. As particular examples, sensor data the sensor data can be data from an image, distance, or position sensor or from an actuator. For example in the case of a robot, the sensor data may include data characterizing the current state of the robot, e.g., one or more of: joint position, joint velocity, joint force, torque or acceleration, e.g., gravity-compensated torque feedback, and global or relative pose of an item held by the robot. The sensor data may also include, for example, sensed electronic signals such as motor current or a temperature signal; and/or image or video data for example from a camera or a LIDAR sensor, e.g., data from sensors of the agent or data from sensors that are located separately from the agent in the environment.

The neural network110can have any architecture that is appropriate for the type of network inputs processed by the neural network110. For example, when the model inputs are images, the neural network110can be a convolutional neural network.

The training data140that is used by the system100to train the neural network110includes multiple batches of training inputs142and, for each training input, a respective target output144. Each batch can include, e.g., 64, 128, 256, or 512 inputs. The target output144for any given training input142is the output that should be generated by the neural network110by performing the particular machine learning task on the labeled training input.

Generally, a training engine150in the system100trains the neural network110by performing an iterative training process on batches of training inputs. At each iteration, the training engine150receives (i) network outputs114generated by the neural network110for training inputs142in the batch corresponding to the training iteration in accordance with current values of the network parameters118and (ii) target outputs144for the training inputs142in the batch. The training engine150uses the network outputs114and the target outputs144to update the current values of the network parameters118.

More specifically, conventionally the training engine150would train the neural network110to minimize a loss function that measures a difference between (i) an output generated by the neural network110by processing an input in an input-output pair and (ii) an output in the input-output pair. In conventional training, each input in each input-output pair would be one of the training inputs142and the output would be the target output144for the training input.

The loss function can be any machine learning loss function that is appropriate for the task that the neural network is being trained to perform. For example, when the task is image classification, the loss function can be the cross-entropy loss function.

Accordingly, the loss function will be referred to in this specification as the “task loss function.”

However, to make the trained neural network110more secure, i.e., less susceptible to adversarial attack, the training engine150regularizes the training using a perturbation engine160. In other words, the training engine150instead trains the neural network110on a local linearity regularized loss function that includes one term corresponding to the task loss function and one or more additional regularization terms that measure the non-linearity of the task loss function near the training inputs in the batch.

In particular, at each iteration, the perturbation engine160identifies, from a plurality of possible perturbations, a maximally non-linear perturbation for the batch.

A perturbation, as used in this specification, is a set of values that (i) is the same dimensionality as the training inputs, i.e., that includes a corresponding value for each value in a given training input, and (ii) that has a norm, e.g., a Euclidean norm or an infinity norm, that does not exceed a threshold value. A perturbation can be applied to a training input by element-wise adding the perturbation and the training input.

For example, when the inputs are images, the norm is the infinity norm, and pixels take values ranging between 0 and 255, a threshold value of 4/255 would mean that applying a randomly selected perturbation to a training input results in every pixel of the training input being perturbed independently by up to 4 units up or down on the 0 to 255 scale.

As another example, when the inputs are images, the norm is the infinity norm, and pixels take values ranging between 0 and 255, a threshold value of 6/255 would mean that applying a randomly selected perturbation to a training input results in every pixel of the training input being perturbed independently by up to 6 units up or down on the 0 to 255 scale.

The maximally non-linear perturbation is a perturbation for which the task loss function is most non-linear (from among the plurality of possible perturbations that are considered by the perturbation engine160) when evaluated at an input-output pair that includes (i) a perturbed training input generated by applying the possible perturbation to a given training input and (ii) a target output for the given training input.

At a given iteration, the training engine150then determines the update to the current values of the network parameters118by performing an iteration of a neural network training procedure to minimize the local linearity regularized loss function, i.e., to decrease losses for the training inputs (as measured by the task loss function) and to decrease the non-linearity of the task loss function for the maximally non-linear perturbation identified by the perturbation engine160.

Performing an iteration of training and identifying a maximally non-linear perturbation are described in more detail below with reference toFIGS.2-4.

The training engine150can continue performing iterations of the training process to update the values of the network parameters118until termination criteria for the training are satisfied, e.g., a specified number of training iterations have been performed, a specified amount of time has elapsed, or the network parameters118have converged.

Once the neural network110has been trained, the system100can provide data specifying the trained network for use in processing new network inputs. That is, the system100can output, e.g., by outputting to a user device or by storing in a memory accessible to the system100, the trained values of the network parameters118for later use in processing inputs using the trained network.

Alternatively or in addition to outputting the trained network data, the system100can instantiate an instance of the neural network110having the trained values of the network parameters118, receive inputs to be processed, e.g., through an application programming interface (API) offered by the system, use the trained neural network110to process the received inputs to generate network outputs and then provide the generated network outputs in response to the received inputs.

FIG.2is a flow diagram of an example process200for training the neural network. For convenience, the process200will be described as being performed by a system of one or more computers located in one or more locations. For example, a neural network training system, e.g., the neural network training system100ofFIG.1, appropriately programmed, can perform the process200.

The system can perform the process200multiple times for multiple different batches to determine trained values of the network parameters from initial values of the model parameters, i.e., can perform the process200repeatedly at different training iterations of an iterative training process to train the neural network.

The system obtains a plurality of training inputs and, for each of the plurality of training inputs, a respective target output for the training input (step202).

The system then trains the neural network on each of the plurality of training inputs.

In particular, the system processes each of the training inputs using the neural network and in accordance with the current values of the network parameters to generate a respective network output for each of the training inputs (step204).

The system computes a respective loss for each of the training inputs (step206).

In particular, the system computes the respective loss a given training input by evaluating the task loss function for an input-output pair that includes the given training input and the target output for the given training input.

That is, the system evaluates, at the input-output pair that includes the given training input and the target output for the given training input, a loss function that measures a difference between (i) an output generated by the neural network by processing an input in an input-output pair and (ii) an output in the input-output pair.

The system identifies, from a plurality of possible perturbations, a maximally non-linear perturbation (step208).

As described above, the maximally non-linear perturbation is a perturbation for which the task loss function is most non-linear (from among the possible perturbations) when evaluated at an input-output pair that includes (i) a perturbed training input generated by applying the perturbation to a given training input and (ii) a target output for the given training input.

Identifying the maximally non-linear perturbation is described below with reference toFIG.3.

The system determines an update to the current values of the parameters of the neural network by performing an iteration of a neural network training procedure to decrease the respective losses for the training inputs and to decrease the non-linearity of the loss function for the identified maximally non-linear perturbation (step210).

In particular, the system can perform the iteration of the neural network training procedure to minimize a local linearity regularized loss function that measures at least the respective losses for the plurality of training inputs and the non-linearity for the identified maximally non-linear perturbation.

In particular, the system can determine, e.g., through backpropagation, a respective gradient with respect to the network parameters of the local linearity regularized loss function for each of the plurality of training examples and determine an averaged gradient with respect to the network parameters from the respective gradients for the plurality of training examples, i.e., by computing an average of the respective gradients.

The system can then determine an update to the current values of the network parameters from the averaged gradient, e.g., by applying an update rule, e.g., a learning rate, an Adam optimizer update rule, or an rmsProp update rule, to the gradient to generate an update.

The system then generates updated values of the network parameters by applying the update, i.e., by subtracting or adding, to the current values of the network parameters.

Generally, the local linearity regularized loss function includes one term that measures an average loss for the plurality of training examples and one or more terms that are based on the identified maximally non-linear perturbation. For example, the local linearity regularized loss function can be a sum or a weighted sum of the multiple terms.

In particular, the average loss term for a batch i can be expressed as follows:

1b⁢∑j=1bl⁡(xij;yij),
where b is the total number of training inputs in the batch i, l represents the task loss function, and l(xij; yij) is the task loss function evaluated at the input-output pair that includes the j-th training input xijin the batch i and the target output yijfor the j-th training input xijin the batch i.

To measure the non-linearity of the task loss function at the identified maximally non-linear perturbation, the local linearity regularized loss function can include a second term that measures an average across the plurality of training inputs of an absolute difference between (i) the task loss function evaluated at an input-output pair that includes 1) the training input perturbed with the maximally non-linear perturbation and 2) the target output for the training input and (ii) a first-order Taylor expansion of the task loss function evaluated at the input-output pair that includes 1) the training input perturbed with the maximally non-linear perturbation and 2) the target output for the training input. In particular, the second term can be expressed as:

1b⁢∑j=1bλg⁡(δ;xij,yij),where⁢g⁡(δ;xij,yij)=❘"\[LeftBracketingBar]"l⁡(xij+δ,yij)-l⁡(xij,yij)-δT⁢∇xijl⁡(xij,yij)❘"\[RightBracketingBar]",
and where δ is the identified maximally non-linear perturbation and λ is the weight assigned to the third term.

In some cases, in addition to the second term, the local linearity regularized loss function can also include a third term that measures the change in loss when the maximally non-linear perturbation is applied to a training input as predicted by the gradient of the loss with respect to the training input.

In particular, the third term can be an average across the plurality of training inputs of an absolute value of a dot product between (i) the maximally non-linear perturbation and (ii) a gradient with respect to the training input of the loss function evaluated at the input-output pair that includes the training input and the target output for the training input. In other words, the third term can be expressed as:

1b⁢∑j=1bμ⁢❘"\[LeftBracketingBar]"δT⁢∇xijl⁡(xij,yij)❘"\[RightBracketingBar]",
where μ is the weight assigned to the third term.

By incorporating the second term and, optionally, the third term into the local linearity regularized loss function, i.e., in addition to the term corresponding to the task loss function, the system can train the system to be robust to adversarial attack in a computationally efficient manner.

FIG.3is a flow diagram of an example process300for identifying the maximally non-linear perturbation for a given batch. For convenience, the process300will be described as being performed by a system of one or more computers located in one or more locations. For example, a neural network training system, e.g., the neural network training system100ofFIG.1, appropriately programmed, can perform the process300.

The system initializes a perturbation (step302). For example, the system can sample the perturbation uniformly at random from the possible perturbations having a norm that does not exceed the threshold value.

The system then performs one or more iterations of steps304-312. The number of iterations can be fixed prior to training or can be determined through hyper-parameter search at the outset of training. For example the number of iterations can be equal to 1, 2, 4, 8 or 16.

For each of the training inputs, the system generates a respective perturbed training input by applying the perturbation (as of the current iteration) to the training input (step304). As described above, the system can apply a perturbation to an input by adding, i.e., element-wise adding, the perturbation and the training input.

For each of the training inputs, the system processes the perturbed training input generated from the training input using the neural network and in accordance with the current values of the network parameters to generate a network output for the perturbed training input (step306).

For each of the training inputs, the system determines, using the network output for the perturbed training input, a gradient of a local linearity measure with respect to the perturbation and evaluated at the perturbed input for the training input (step308).

Generally, the local linearity measure measures how non-linear the loss function is when evaluated at an input-output pair that includes (i) the perturbed training input and (ii) the target output for the training input.

As a particular example, the local linearity measure can be an absolute difference between (1) the loss function evaluated at the input-output pair that includes (i) the perturbed training input and (ii) the target output for the training input and (2) a first-order Taylor expansion of the loss function evaluated at the input-output pair. In other words, the local linearity measure g for a given training input x and a perturbation δ can satisfy:
g(δ;x)=|l(x+δ)−l(x)−δT∇xl(x)|,
where l(x+δ) is the loss function evaluated at the input-output pair that that includes (i) the perturbed training input and (ii) the target output for the training input, l(x) is the loss function evaluated at the input-output pair that that includes (i) the training input and (ii) the target output for the training input, and ∇xl(x) is the gradient of l(x) with respect to the training input x.

The system can compute the gradient of the measure with respect to the perturbation using a conventional gradient computation technique, e.g., through backpropagation.

The system generates an averaged gradient of the local linearity measure by averaging the gradients of the local linearity measure for the training inputs (step310).

The system updates the perturbation using the averaged gradient (step312). Generally, the system can apply a gradient descent technique to the averaged gradient and the current perturbation to generate an updated perturbation.

For example, the gradient descent technique can be a projected gradient descent (PGD) technique, which updates the perturbation as follows:
δ←Proj(δ−s×Optimizer(gradient)),
where gradient the averaged gradient, s is a step size hyperparameter, and Optimizer is an update rule that is applied to the averaged gradient, e.g., the Adam update rule or the rmsProp update rule.

As another example, the technique can be a Fast Gradient Signed Method (FGSM) technique, as described in Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572, 2014.

After completing all of the iterations of steps304-312, the system selects the perturbation after the last iteration of the one or more iterations as the maximally non-linear perturbation (step314).

Thus, like some existing techniques for training neural networks to be more robust to adversarial attack, the described techniques also require an inner optimization to be performed to identify a perturbation that satisfies some criteria. However, as compared to these existing techniques, many fewer optimization steps (number of iterations of steps304-312) are required for the described techniques to be effective in training the neural network to be robust to adversarial attack. Because as the number of inner optimization steps increases, the inner optimization becomes the dominant factor in how computationally intensive the training process is, by performing fewer optimization steps the described training techniques become much more computationally efficient than existing techniques.

In particular, because the optimization steps are performed to find the maximally non-linear perturbation and because this non-linear perturbation is then used to regularize the training of the neural network through one or more separate regularization terms in the loss function, robustness to adversarial attack can be achieved in a much more computationally efficient manner than existing techniques that, e.g., perform the inner optimization to identify an adversarial perturbation that results in the largest change in the task loss of any possible perturbation.

Alternatively, if the same number of optimization steps are used to train the network using both the described techniques and the existing techniques, the trained neural network may be more robust to adversarial attacks, i.e., both attacks from a strong adversary and a weak adversary, if trained using the described techniques.

In one example, the total training wall clock time for a network having a threshold value of 4/255 was 7 hours for 110 epochs of training using the described techniques. By comparison, using conventional adversarial training with the same number of inner optimization steps, the total training wall clock time was 36 hours for 110 epochs. Therefore a five times speed-up in training time was achieved. After training, the network trained using the described techniques exhibited better robustness to adversarial attack despite the speed-up in training time.

FIG.4shows the non-linearity of the task loss function around a particular training input.

In particular,FIG.4shows 4 visualizations of the surface of the task loss around the particular training input.

Visualization410shows the surface of the task loss around the particular training input when the neural network has been trained using adversarial training (“ADV”) with one inner optimization step (ADV-1). Visualization420shows the surface of the task loss around the particular training input when the neural network has been trained using the described techniques (“LLR”) with the same number, i.e., one, of inner optimization steps (LLR-1).

As can be seen from visualizations420and410, the loss surface is much more linear after training using LLR than after training using ADV with the same number of inner optimization steps.

Visualization430shows the surface of the task loss around the particular training input when the neural network has been trained using adversarial training with two inner optimization step (ADV-2). Visualization440shows the surface of the task loss around the particular training input when the neural network has been trained using the described techniques with the same number, i.e., two, of inner optimization steps (LLR-2).

Again, as can be seen from visualizations440and430, the loss surface is much more linear after training using LLR than after training using ADV with the same number of inner optimization steps. Moreover, as can be seen by comparing visualization430to visualization420, the loss surface is more linear after one inner optimization step when training using LLR than after two inner optimization steps when training using ADV.

Producing a more linear loss surface avoids having the trained neural network only being robust against weak attacks, i.e., but breaking down under strong adversarial attacks, e.g., due to gradient obfuscation. In particular, one form of gradient obfuscation occurs when the network learns to fool a gradient based attack by making the loss surface highly convoluted and non-linear. In turn the nonlinearity prevents gradient based optimization methods from finding an adversarial perturbation within a small number of iterations and therefore decreases the effectiveness of the training. In contrast, when the loss surface is linear in the vicinity of the training examples, which is to say well-predicted by local gradient information, gradient obfuscation cannot occur. Thus, because the described techniques can generate more linear loss surfaces in fewer inner optimization steps, training using the described techniques yields trained neural networks that are more robust to both strong and weak adversarial attacks than networks trained using other existing techniques.