Year: 2020

Abstract:
Adversarial training is an effective method to combat adversarial attacks in order to create robust neural networks. By using an auxiliary batch normalization on adversarial examples, it has been shown recently to possess great potential in improving the generalization ability of neural networks for image recognition as well. However, crafting pixel-level adversarial perturbations is computationally expensive. To address this issue, we propose AdversariaL Feature Augmentation (ALFA), which advocates adversarial training on the intermediate layers of feature embeddings. ALFA utilizes both clean and adversarial augmented features jointly to enhance standard trained networks. To eliminate laborious tuning of key parameters such as locations and strength of feature augmentations, we further design a learnable adversarial feature augmentation (L-ALFA) framework to automatically adjust the perturbation magnitude of each perturbed feature. Extensive experiments demonstrate that our proposed ALFA and L-ALFA methods achieve significant and consistent generalization improvement over strong baselines on CIFAR-10, CIFAR-100 and ImageNet benchmarks across different backbone networks for image recognition.

heading: 1 INTRODUCTION
text: Neural networks often fall vulnerable when presented adversarial examples injected with imperceptible perturbations, and suffer significant performance drop when facing such attacks (Szegedy et al., 2013; Goodfellow et al., 2015b). Such susceptibility has motivated abundant studies on adversarial defense mechanisms for training robust neural networks (Schmidt et al., 2018; Sun et al., 2019; Nakkiran, 2019; Stutz et al., 2019; Raghunathan et al., 2019), among which adversarial training based methods (Madry et al., 2018b; Zhang et al., 2019a) have achieved consistently superior robustness than others.
The general focus of adversarial training is to enhance the robustness of gradient-based adversarial examples. A few recent studies (Zhu et al., 2020; Gan et al., 2020) turn to investigate the generalization ability of adversarial training on language models. However, in-depth exploration of extending this to the vision domain is still missing. Xie et al. (2020) proposes to utilize adversarial examples with an auxiliary batch normalization to improve standard accuracy for image recognition, but it still suffers from expensive computational cost from the generation of pixel-level perturbations.
To address this issue, we propose AdversariaL Feature Augmentation (ALFA) as a natural extension of adversarial training, with a focus on leveraging adversarial perturbations in the feature space to improve image recognition on clean data. As illustrated in Figure 1, ALFA introduces adversarial perturbations to multiple intermediate layers. These perturbed feature embeddings act as a special feature augmentation and implicit regularization to enhance the generalization ability of deep neural networks. Consequently, two challenges arise: (i) how to efficiently find the best locations to introduce adversarial perturbations; and (ii) how to decide on the strength of the created perturbations. Although a few recent works (Zhu et al., 2020; Gan et al., 2020; Sankaranarayanan et al., 2017) look into this field, they either add perturbations in the input embeddings or all the intermediate features, yet have not reached a coherent conclusion.
To efficiently learn an optimal strategy of perturbation injection, we further propose a learnable adversarial feature augmentation (L-ALFA) framework, which is capable of automatically adjusting the position and strength of introduced feature perturbations. The proposed approach not only
circumvents laborious hyper-parameter tuning, but also fully unleashes the power of adversarial feature augmentation. Experiments show that this strategy gains a substantial performance margin over existing feature augmentation methods (Li et al., 2020). In addition, we find that learnable ALFA and exhaustively-tuned ALFA exhibit consistent patterns: applying weak adversarial feature augmentations to the last layers of deep neural networks can boost generalization performance.
The main contributions are summarized as follows. (i) We introduce a new approach of adversarial feature augmentation (ALFA) to improve the generalization ability of neural networks, which applies adversarial perturbations to the feature space rather than raw image pixels. (ii) To tackle the dilemma of laborious hyper-parameter tuning in generating adversarial features, we propose learnable adversarial feature augmentation (L-ALFA) to automatically tailor target perturbations and their locations. (iii) Comprehensive experiments on CIFAR-10, CIFAR-100, and ImageNet datasets across multiple backbone networks demonstrate the superiority of the proposed methods.

heading: 2 RELATED WORK
text: Adversarial Training Deep neural networks are notoriously vulnerable to adversarial samples (Szegedy et al., 2013; Goodfellow et al., 2015b), which are crafted with malicious yet negligible perturbations (Goodfellow et al., 2015a; Kurakin et al., 2016; Madry et al., 2018a). In order to improve the robustness against adversarial samples, various defense mechanisms have been proposed (Zhang et al., 2019a; Schmidt et al., 2018; Sun et al., 2019; Nakkiran, 2019; Stutz et al., 2019; Raghunathan et al., 2019). Among these works, adversarial-training-based methods (Madry et al., 2018b; Zhang et al., 2019a) have achieved consistently superior performance in defending stateof-the-art adversarial attacks (Goodfellow et al., 2015a; Kurakin et al., 2016; Madry et al., 2018a). Although adversarial training substantially improves model robustness, it usually comes at the price of compromising the standard accuracy (Tsipras et al., 2019), which has been demonstrated both empirically and theoretically (Zhang et al., 2019a; Schmidt et al., 2018; Sun et al., 2019; Nakkiran, 2019; Stutz et al., 2019; Raghunathan et al., 2019).
Recently, researchers start to investigate improving clean set accuracy with adversarial training (Xie et al., 2020; Zhu et al., 2020; Wang et al., 2019a; Gan et al., 2020; Wei & Ma, 2019) (Ishii & Sato, 2019). Xie et al. (2020) shows that performance on the clean dataset can be enhanced by using adversarial samples with pixel-level perturbation generation. Zhu et al. (2020) and Wang et al. (2019a) apply adversarial training to natural language understanding and language modeling, both successfully achieving better standard accuracy. Gan et al. (2020) achieves similar success on many vision-and-language tasks. There also exist parallel studies that employ handcrafted or auto-
generated perturbed features to ameliorate generalization (Wei & Ma, 2019) (Ishii & Sato, 2019) or robustness (Sankaranarayanan et al., 2017).
However, two key issues remain unexplored: (i) which layers to introduce adversarial feature augmentations; (ii) how strong the perturbations should be. For the former, Zhu et al. (2020); Wang et al. (2019a); Gan et al. (2020) try to perturb the input embeddings of transformer models, while Wei & Ma (2019); Sankaranarayanan et al. (2017) insert perturbations to all layers of a convolutional network. Regarding the above issue, all the methods need arduous and heuristic tunings. In our paper, we present a different observation that augmenting the last layers’ feature embeddings with weak adversarial feature perturbations can gain higher standard accuracy. The L-ALFA framework inspired by this observation can effectively alleviate laborious tuning, which otherwise is inevitable.
Feature Augmentation Although pixel-level data augmentation techniques (Simard et al., 1993; Schölkopf et al., 1996) have been widely adopted, feature space augmentations have not received the same level of attention. A few pioneering works propose generative-based feature augmentation approaches for domain adaptation (Volpi et al., 2018), imbalance classification (Zhang et al., 2019b), and few-shot learning (Chen et al., 2019). Another loosely related field is feature normalization (Ioffe & Szegedy, 2015; Li et al., 2020). MoEx (Li et al., 2020) is a newly proposed method that can be regarded as a feature augmentation technique, which leverages the first and second-order moments extracted and re-injected by feature normalization. It is worth mentioning that all the approaches aforementioned are orthogonal to our proposed method, and can be combined for further generalization improvement, which is left as future work.

heading: 3 ADVERSARIAL FEATURE AUGMENTATIONS (ALFA)
text: In the proposed ALFA framework, we generate adversarial perturbations in the intermediate feature embedding space, rather than applying perturbations to raw image pixels as in common practice. Thus, adversarial training can be formulated as an effective regularization to improve the generalization ability of deep neural networks.

heading: 3.1 NOTATIONS
text: Given a dataset D = {x, y}, where x is the input image and y is the corresponding one-hot groundtruth label. Let f(x; Θ) represents predictions of a deep neural networks, and fi(x; Θ(i))|r+1i=1 is the intermediate feature embedding from the i-th layer. The (r + 1)-th layer denotes the classifier, therefore fr+1(x; Θ(r+1)) = f(x; Θ). Adversarial training can be formulated as the following min-max optimization problem:
min Θ
E(x,y)∈D [
max ||δ||p≤
Lat(f(x + δ; Θ); Θ; y) ] , (1)
where δ is the adversarial perturbation bounded by the `p norm ball, which is centered at x with radius which is the maximum perturbation magnitude. Lat is the cross-entropy loss for adversarial training (AT). E(x,y)∈D takes the expectation over the empirical objective on the training dataset D. The inner optimization generates adversarial perturbation δ via maximizing the empirical objective. It can be reliably solved by multi-step projected gradient descent (PGD) (Madry et al., 2018b) (without loss of generality, we take || · ||∞ perturbation as an example):
δt+1 = Π||δ||∞≤ [δt + α · sgn(∇xLat(f(x + δt; Θ); Θ; y)] , (2) where t is the number of steps, α denotes the learning rate of inner maximization, sgn is the sign function, and Lat is the adversarial training objective on adversarial images.

heading: 3.2 PERTURBATIONS IN THE EMBEDDING SPACE VIA ALFA
text: Here, we extend the conventional adversarial perturbations to the feature embedding space. We start from the training objective of ALFA as follows:
min Θ E(x,y)∈D
[ Lstd(x; Θ; y) + λ ·
∑ i max ||δ(i)||∞≤ Lat(fi(x; Θ(i)) + δ(i); Θ; y)
] , (3)
where Lstd is the cross-entropy (XE) loss on clean images, Lat here is the cross-entropy loss for adversarial training (AT) on adversarial augmented feature embeddings. λ is the hyperparamter to control the influence of AT regularization, which is tuned by grid search. δ(i) is the adversarial perturbation on the feature of layer i, generated as follows:
δ (i) t+1 = Π||δ||∞≤ [ δ (i) t + α · sgn(∇xLat(fi(x; Θ(i)) + δ (i) t ; Θ; y)) ] . (4)
It is worth noting that, for crafting δ(i), at each step, the gradient is only back-propagated to the i-th layer without going further, which is much more computationally efficient compared to generating perturbations in the input embedding space. In practice, we set the maximum magnitude of crafted feature perturbation to be unbounded, and the projected gradient descent will be replaced by gradient descent.
In ALFA, the two most essential factors are: (i) where to introduce adversarial perturbations; and (ii) how strong the perturbations should be. Table 1 and Figure 2 present some preliminary results to understand this. Results shows that the performance of ALFA relies particularly on the location (i.e., which blocks) and strength (i.e., step size α) of the introduced feature perturbations. An inadequate configuration (e.g., applying ALFA to all blocks 1, 2 and 3 as shown in Figure 2) might cause accuracy degradation. More analyses are provided in Section 4.3. To determine the best configuration, we further design a learnable adversarial feature augmentation (L-ALFA) approach to automatically adjusting the location and strength of perturbations for best augmentation performance, which will be explained in the next sub-section.

heading: 3.3 LEARNABLE PERTURBATIONS VIA L-ALFA
text: To ascertain the two critical settings (locations and strength) of feature augmentations, we introduce an enhanced ALFA method, L-ALFA, which also eliminates laborious tuning. Specifically, in layer i, for the PGD-generated perturbation δ(i), we apply a learnable parameter ηi to control the magnitude of δ(i) before adding it to the corresponding feature embeddings. Thus, a learned near-zero ηi indicates that it is unnecessary to inject feature perturbations on layer i. Furthermore, we also introduce the `1 sparsity constraint on the learnable perturbation magnitude η. The design philosophy is that applying ALFA on all layers of deep neural network does not benefit (or even hurt) the standard accuracy, as exemplified in Figure 2 and Figure 3.
The optimization problem is then formulated as:
min Θ,{ηi}r1,η∈P E(x,y)∼D
[ Lstd + λ ·
r∑ i=1 max ||δ(i)||∞≤ Lat(fi(x; Θ(i)) + ηi · δ(i); Θ; y) + γ · ||η||1
] ,
(5)
where Lstd = LXE(x; y; Θ), P = {η|1Tη = 1}, η = (η1, η2, · · · , ηr) is the learnable strength of feature perturbations, γ is the hyperparameter to control the sparsity level. γ can be chosen from {0.5, 1.0, 2.0}. To solve equation 5, we first generate feature perturbations δ(i) via multi-step PGD.
Algorithm 1 Learnable Adversarial Feature Augmentation (L-ALFA). 1: Input: given Θ0, η0, δ0. (In our case, η0 = (1, · · · , 1) ∈ Rr) 2: for n = 1, 2, · · · , N iterations do 3: Given Θn−1, ηn−1, generate adversarial perturbation δn = (δ (1) n , · · · , δ(r)n ) via multi-step PGD;
4: Given δn, perform SGD to update Θn, ηn; 5: Project ηn into P via the bisection method (Wang et al., 2019b). 6: end for
Then, we minimize the empirical training objective to update the network weights Θ and η through stochastic gradient descent (SGD) (Ruder, 2016). In the end, we project η into P and repeat the above steps until the training converges. The full algorithm is summarized in Algorithm 1.

heading: 4 EXPERIMENTS
text: We conduct extensive experiments on multiple benchmarks to validate the generalization ability of ALFA and L-ALFA, evaluating across different backbone networks for image recognition. Ablation studies and analysis of the learned distribution of perturbation magnitude are also provided.

heading: 4.1 EXPERIMENTAL SETUP
text: Datasets and Backbones We consider three representative datasets: CIFAR-10, CIFAR-100 (Krizhevsky et al., 2009), and ImageNet (Deng et al., 2009). In our experiments, the original training datasets are randomly split into 90% training and 10% validation. The early stopping technique is applied to find the top-performing checkpoints on the validation set. Then, the selected checkpoints are evaluated on the test set to report the performance. From our observations, the hyperparameters are quite stable from validation to test sets. We evaluate large backbone networks (ResNet18/50/101/152 (He et al., 2016)) on all three datasets, and test smaller backbones (ResNet-20s/56s) as well on CIFAR-10 and CIFAR-100. Ablation studies are implemented on CIFAR-10, where key observations can be generalized to other datasets.
Training and Metrics For network training on CIFAR-10 and CIFAR-100, we adopt an SGD optimizer with a momentum of 0.9, weight decay of 5 × 10−4, and batch size of 128 for 200 epochs. The learning rate starts from 0.1 and decays to one-tenth at 50-th and 150-th epochs. We also perform a linear learning rate warm-up in the first 200 iterations. For ImageNet experiments, following the official setting in Pytorch repository,1 we train deep networks for 90 epochs with a batch size of 512, and the learning rate decay at 30-th and 60-th epoch. The SGD optimizer is adopted with a momentum of 0.9 and a weight decay of 1 × 10−4. We evaluate the generalization ability of a network with Standard Testing Accuracy (SA), which represents image recognition accuracy on the original clean test dataset.

heading: 4.2 EVALUATION AND ANALYSIS OF ALFA
text: For ALFA experiments, all hyperparameters are tuned by grid search, including PGD steps, step size α, and the layers to introduce adversarial perturbations. For generated adversarial feature embeddings, we set the maximum perturbation magnitude to be unbounded 2, since there are no explicit constraints for feature perturbations, and the effect of tuning can be absorbed by adjusting PGD steps and step size α.
Table 2 presents the standard testing accuracy of different models on CIFAR-10. Comparing the standard training with our proposed ALFA, here are the main observations:
(i) ALFA obtains a consistent and substantial improvement over standard accuracy, e.g., 1.27% on ResNet-20s, 1.69% on ResNet-56s, and 0.51% on ResNet-50. This suggests that training with augmented features generated by ALFA effectively enhances the generalization of
1https://github.com/pytorch/examples/tree/master/imagenet 2In practice, the magnitude of crafted feature perturbation steadily stays in a range from 0.97 to 1.10 under the `2 norm. Adversarial perturbations usually are applied to the normalized feature from batch normalization.
Results on CIFAR-100 and ImageNet are summarized in Table 3. We observe that ALFA consistently boosts the generalization ability of multiple ResNets on both CIFAR-100 and ImageNet, e.g., 1.14% for ResNet-56s on CIFAR-100, 1.02% for ResNet-50 on ImageNet. Furthermore, we notice that ALFA advocates different steps of PGD to achieve superior performance on diverse datasets. To fully understand these sensitive yet critical factors, we conduct a systematical and comprehensive ablation study in the next sub-section.

heading: 4.3 ABLATION STUDIES
text: Strength and Locations of ALFA To understand the effect or the strength of injected adversarial perturbations, we implement ResNet-18 on CIFAR-10 and examine the performance across different step sizes and numbers of PGD steps. Table 4 shows that perturbing with step size α = 1.0/255 obtains a larger gain by 0.35% SA. In addition, excessive weak (e.g., α = 0.5/255) or strong (e.g., α = 1.5/255) adversarial feature augmentations may incur performance degradation. For the ablation of PGD steps, we implement ResNet-18 on ImageNet as well. Table 5 demonstrates that ALFA with PGD-5 and PGD-1 works the best for CIFAR-10 and ImageNet, respectively, indicating that the strength of generated perturbations is an essential and sensitive hyperparameter for ALFA.
Then, we analyze the effect of locations (i.e., where to apply ALFA) via two typical backbones: ResNet-56s on CIFAR-10 and ResNet-18 on ImageNet. In each setting, we present a detailed analysis on which layer and how many layers the feature embeddings should be adversarially augmented for achieving the best performance. Figure 3 presents the layer preference of feature perturbations when applying ALFA to different blocks or some combinations of blocks. We notice that introducing ALFA to the last block achieves better standard accuracy, while the performance deteriorates
Table 4: Standard testing accuracy (%) on CIFAR-10 dataset. We perturb the feature embeddings in the last block of ResNet-18 via PGD-5 and diverse step size α. For reference, SA of standard trained model is 94.30%. ↑/↓ indicates SA improvement/degradation compared to the corresponding baseline in standard training.
Step size α 0.5255 1.0 255
1.5 255
2.0 255
4.0 255
ALFA 93.15 (↓ 1.15) 94.65 (↑ 0.35) 94.34 (↑ 0.04) 94.36 (↑ 0.06) 93.30 (↓ 1.00)
Table 5: Standard testing accuracy (%) on CIFAR-10 and ImageNet datasets. For CIFAR-10, we perturb the feature embeddings in the last block of ResNet-18, via PGD-1/3/5/7/10 with step size α = 1.0/255. As a reference, the SA of standard trained model is 94.30%. As for ImageNet, we also perturb the last block features of ResNet-18 via PGD-1/3/5 and step size α = 0.5/255. The reference SA is 69.38%.
after injecting ALFA to multiple blocks. These results demonstrate that the strength and location for ALFA play a crucial role and need to be cautiously selected, which motivates us to design the learnable framework, L-ALFA.
ALFA vs. Other Feature Augmentations One natural baseline is adding random noise to the feature embeddings. For each training iteration, a new random noise sampled from a Gaussian distribution N (0, (1.0/255)2) is applied to the same feature embeddings. Another representative feature augmentation recently proposed is MoEx3 (Li et al., 2020), which is compared as another baseline. For ALFA, we choose the best hyperparameter configurations for ResNet-56s and ResNet-18 on CIFAR-10, i.e., perturbing the last block feature embeddings with PGD-5, and step size (α = 1.5255 for ResNet-56s and α = 1.0255 for ResNet-18). As shown in Table 7, ALFA significantly surpasses MoEx and random-noise-based feature augmentation, demonstrating that feature perturbations generated from ALFA are non-trivial.
ALFA vs. AdvProp We compare ALFA with AdvProp (Xie et al., 2020) on CIFAR-10 with ResNet-18 and on ImageNet with EfficientNet-B0 (Tan & Le, 2019), as presented in Table 6. Training on a single GTX1080 Ti GPU for CIFAR-10 experiments, AdvProp achieves 94.52% accuracy with 123 seconds per epoch; ALFA obtains 94.65% with 28 seconds per epoch, where standard training takes 23 seconds per epoch. The experiments on ImageNet (batch size 256) are conducted on 2 Quadro RTX 6000 GPUs with 24G×2 memory in total, and the reported running time is per epoch.
3We implement MoEx based on their released repository, https://github.com/Boyiliee/MoEx
As shown in Table 6, ALFA obtains a similar performance improvement with less computational cost, compared with pixel-level adversarial augmentations (e.g., AdvProp).
Robust Performance of ALFA Although the robust testing accuracy (RA) is not the focus of ALFA, we report it for completeness. We implement the standard, ALFA and the adversarial trained ResNet-18 networks on CIFAR10. The adversarial trained model uses PGD-10 with step size α = 2255 and = 8 255 for training. Then, PGD-20 with the same α and is applied to evaluate the robust performance of the three models. We observe that ALFA trained models (4.86% RA) yield moderate robustness, compared to models from standard (0.00% RA) and adversarial (50.72% RA) trained models.

heading: 4.4 EVALUATION AND ANALYSIS OF L-ALFA
text: Results on L-ALFA are presented in Table 8 and Figure 4. L-ALFA consistently improves the generalization of trained networks by 0.32% on CIFAR-10, 1.18% on CIFAR-100, and 0.91% on ImageNet. Although the achieved performance is close to ALFA, L-ALFA saves toilsome tuning by automatically adjusting the strength and locations of adversarial feature augmentations. Another interesting finding is that L-ALFA automatically learns the effective trick of only perturbing the last block feature embeddings, which is consistent with our observations made from ALFA.
Number of Perturbed Layers To study the effect of the dimension of the learnable perturbation magnitude η in LALFA, we implement ResNet18 on CIFAR-10 for the additional experiment. ResNet-18
has four residual blocks and twenty convolution layers, and perturbing them will result in dim(η) being equal to 4 and 20, respectively. We also try introducing adversarial feature augmentations to only some of the intermediate layers, such as perturbing the features after each skip connection (i.e., dim(η) = 9). As shown in Table 9, an unduly high dimension of η, i.e., perturbing features in almost all the layers, is harmful to model generalization. Therefore, learning feature perturbations by blocks or by skip connections is adequate for L-ALFA.
Ablation of the `1 regularization in L-ALFA Results of ResNet-56s on CIFAR-100 are collected in Table 10. We observe that γ can be roughly chosen from {0.5, 1.0, 2.0} and obtain similar competitive performance. Excessive large or small values of γ obtain less performance improvements or even incur degradation.

heading: 5 CONCLUSION
text: In this paper, we present ALFA, an advanced adversarial training framework for image recognition. By applying adversarial perturbations on feature embeddings, and by jointly training with both clean and adversarial augmented features, ALFA improves the generalization of diverse neural network backbones across multiple image recognition datasets such as ImageNet. Systematical ablation studies reveal that introducing weak adversarial feature augmentations to the last layers of networks contributes more, which is different from previous findings. Furthermore, we propose L-ALFA to learn a better augmentation, and also save the laborious tuning on ALFA. For future work, we plan to extend the ALFA to other vision tasks, such as object detection and semantic segmentation.

Review summaries:
Overview of paper: this work tackles the task of adversarial augmentation for better generalization. Instead of augmentation the pixels space, which is expensive and potentially harder, they augment the intermediate feature representation. As the choice of the particular layer for application of the perturbations affects performance, the authors, optimize it jointly with the rest of the parameters. Experiments show this method  improves accuracy over standard training.