Abstract:
Adversarial robustness, mainly including sensitivity-based robustness and spatial robustness, plays an integral part in the robust generalization. In this paper, we endeavor to design strategies to achieve comprehensive adversarial robustness. To hit this target, firstly we investigate the less-studied spatial robustness and then integrate existing spatial robustness methods by incorporating both local and global spatial vulnerability into one spatial attack design. Based on this exploration, we further present a comprehensive relationship between natural accuracy, sensitivity-based and different spatial robustness, supported by the strong evidence from the perspective of representation. More importantly, in order to balance these mutual impact within different robustness into one unified framework, we incorporate the Pareto criterion into the adversarial robustness analysis, yielding a novel strategy towards comprehensive robustness called Pareto Adversarial Training. The resulting Pareto front, the set of optimal solutions, provides the set of optimal balance among natural accuracy and different adversarial robustness, shedding light on solutions towards comprehensive robustness in the future. To the best of our knowledge, we are the first to consider comprehensive robustness via the multi-objective optimization.

heading: 1 INTRODUCTION
text: Robust generalization can serve as an extension of tradition generalization, i.e., Empirical Risk Minimization in the case of i.i.d. data (Vapnik & Chervonenkis, 2015), where the test environments might differ slightly or dramatically from the training environment (Krueger et al., 2020). Improving the robustness of deep neural networks has been one of the crucial research topics, with various different threads of research, including adversarial robustness (Goodfellow et al., 2014; Szegedy et al., 2013), non-adversarial robustness (Hendrycks & Dietterich, 2019; Yin et al., 2019), Bayesian deep learning (Neal, 2012; Gal, 2016) and causality (Arjovsky et al., 2019). In this paper, we focus on the adversarial robustness where adversarial examples are carefully manipulated by human to drastically fool the machine learning models, e.g., deep neural networks, posing a serious threat especially on safety-critical applications. Currently, adversarial training (Goodfellow et al., 2014; Madry et al., 2017; Ding et al., 2018) is regarded as one promising and widely accepted strategy to address this issue.
However, similar to Out-of-Distribution (OoD) robustness, one crucial issue is that adversarial robustness also has many aspects (Hendrycks et al., 2020), mainly including sensitivity-based robustness (Tramèr et al., 2020), i.e. robustness against pixel-wise perturbations (normally within the constraints of an lp ball), and spatial robustness, i.e., robustness against multiple spatial transformations. Firstly, in the computer vision and graphics literature, there are two main factors that determine the appearance of a pictured object (Xiao et al., 2018; Szeliski, 2010): (1) the lighting and materials, and (2) geometry. Most previous adversarial robustness focus on the (1) factor (Xiao et al., 2018) based on pixel-wise perturbations, e.g., Projected Gradient Descent (PGD) attacks, assuming the underlying geometry stays the same after the adversarial perturbation. The other rising research branch tackled with the second factor, such as Flow-based (Xiao et al., 2018) and RotationTranslation (RT)-based attacks (Engstrom et al., 2017; 2019). Secondly, by explicitly exploring the human perception, Sharif et al. (2018) pointed out that sensitivity-based robustness, i.e., lp-distance
measured robustness, is not sufficient to adversarial robustness in order to maintain the perceptual similarity. This is owing to the fact that although spatial attacks or geometric transformations also result in small perceptual differences, they yield large lp distances.
In order to head towards the comprehensive adversarial robustness, we find that the crucial issue to investigate the aforementioned whole part of adversarial robustness is the relationships among accuracy, sensitivity-based robustness and spatial robustness. Prior to our work, a clear trade-off between sensitivity-based robustness and accuracy has been revealed by a series of works (Zhang et al., 2019; Tsipras et al., 2018; Raghunathan et al., 2020). Besides, recent work (Tramèr & Boneh, 2019; Kamath et al., 2020) exhibited that there seems to exist an obscure trade-off between RotationTranslation and sensitivity-based robustness. However, this conclusion lacks considering Flowbased attacks (Xiao et al., 2018; Zhang & Wang, 2019), another non-negligible part in the spatial robustness evaluation, making the previous conclusion less comprehensive or reliable. As such, the comprehensive relationships among all the quantities mentioned above are still unclear and remain to be further explored. More importantly, new robust strategy that can harmonize all the considered correlations is needed, in order to achieve optimal balance within the comprehensive robustness.
In this paper, in order to design a new approach towards comprehensive robustness, we firstly explore the two main branches in the spatial robustness, i.e., Flow-based spatial attack (Xiao et al., 2018) and Rotation-Translation (RT) attack (Engstrom et al., 2019). By investigating the different impacts of these two attacks on the spatial sensitivity, we propose an integrated differentiable spatial attack framework, considering both local and global spatial vulnerability. Based on that, we present a comprehensive relationship among accuracy, sensitivity-based robustness and two branches of spatial robustness. Especially we show that the trade-off between sensitivity-based and RT robustness is fundamental trade-off as opposed to the highly interwoven correlation between sensitivity-based and Flow-based spatial robustness. We further provide strong evidence based on their different saliency maps from the perspectives of shape-bias, sparse or dense representation. Lastly, to balance these different kinds of mutual impacts within a unified adversarial training framework, we introduce the Pareto criterion (Kim & De Weck, 2005; 2006; Zeleny, 2012) in the multi-objective optimization, thus developing an optimal balance between the interplay of natural accuracy and different adversarial robustness. By additionally incorporating the two-moment term capturing the interaction between losses of accuracy and different robustness, we finally propose a bi-level optimization framework called Pareto Adversarial Training. The resulting Pareto front provides the set of optimal solutions that balance perfectly all the considered relationships, outperforming other existing strategies. Our contributions are summarized as follows:
• We propose an integrated spatial attack framework that incorporates both local and global spatial vulnerability based on Flow-based and RT attacks, paving the way towards the comprehensive spatial robustness analysis in the future.
• We present comprehensive relationships within accuracy, sensitivity-based, different spatial robustness, supported by strong evidence from the perspective of representation.
• We incorporate the Pareto criterion into adversarial robustness analysis, and are the first attempt to consider multiple adversarial robustness via the multi-objective optimization.

heading: 2 TOWARDS COMPREHENSIVE SPATIAL ROBUSTNESS

heading: 2.1 MOTIVATION
text: In order to better investigate the relationships between accuracy and different kinds of adversarial robustness, we need to firstly provide a fine-grained understanding of spatial robustness, which has been less studied as opposed to sensitivity-based robustness. We summarize two major branches among a flurry of related work about spatial robustness (Engstrom et al., 2017; 2019; Xiao et al., 2018; Zhang & Wang, 2019; Tramèr & Boneh, 2019; Kamath et al., 2020): (1) Flow-based Attacks, and (2) Rotation-Translation (RT) Attacks. Specifically, we find that the former mainly focuses on the local spatial vulnerability while the latter tends to capture the global spatial sensitivity. Our motivation is to firstly shed light on the fundamental difference between these two approaches, and then propose an integrated spatial robustness evaluation metric.

heading: 2.2 INTEGRATED SPATIAL ATTACK: COMBING LOCAL AND GLOBAL SPATIAL SENSITIVITY
text: Local Spatial Robustness: Flow-based Attacks The most representative Flow-based Attack is Spatial Transformed Attack (Xiao et al., 2018), in which a differentiable flow vector wF = (∆µ,∆v) is defined in the 2D coordinate (µ, v) to craft adversarial spatial transformation. The vanilla targeted Flow-based attack (Xiao et al., 2018) (κ = 0) follows the optimization manner:
w∗F = arg min wF max i6=t f iθ(xwF )− f tθ(xwF ) + τLflow(wF ), (1)
where fθ(x) = ( f1θ (x), . . . , f K θ (x) ) is the classifier in the K-classification problem. xwF is Flowbased adversarial example parameterized by flow vector wF . Lflow measures the local smoothness of spatial transformation further balanced by τ .
Interestingly, in our empirical study shown in the left part of Figure 1, we find that Flow-based attack tends to yield local permutations among pixels in some specific regions irrespective of the option of τ , rather than the global spatial transformation based on their shapes. We analyze that this phenomenon is owing to two factors: 1) Local permutations, especially in regions where colors of pixels change dramatically, are already sufficiently sensitive to manipulate, demonstrated by our empirical results shown above. 2) The optimization manner does not incorporate any sort of shape transformation information, e.g., a parameter equation of rotation, as opposed to vanilla RotationTranslation attack, which we present in the following. Thus, Flow-based attacks tend to capture the local spatial vulnerability. Further, for the need to design the integrated spatial attack, we transform Eq 1 into its untargeted version under cross entropy loss with flow vector bounded by an F -ball:
w∗F = arg max wF LCEθ (xwF , y) s.t. ‖wF ‖ ≤ F (2)
where LCEθ (x, y) = log ∑ j exp ( f jθ (x) ) − fyθ (x). One difference compared with Eq. 1 is that we replace local smoothness term Lflow with our familiar lp constraint. Moreover, vanilla Flowbased attack (Xiao et al., 2018) follows the max operation suggested in (Carlini & Wagner, 2017). However we leverage cross entropy loss instead in pursuit of a uniform optimization form in our integrated spatial attack. Proposition 1 reveals the correlation between the two loss, indicating that the smooth approximation version ofmax operation in Eq. 1, denoted as LSθ , has a parallel updating direction with Cross Entropy loss regarding wF . Proof can be found in Appendix A.2. Proposition 1. For a fixed (xwF , y) and θ, consider LSθ (x, y) = log ∑ i 6=y exp ( f iθ(x) ) − fyθ (x), the smooth version loss of Eq. 1 without local smoothness term, then we have
∇wFLCEθ (xwF , y) = r(xwF , y)∇wFLSθ (xwF , y),where r(xwF , y) = ∑ i6=y exp ( f iθ(xwF ) )∑ i exp ( f iθ(xwF )
) . (3) Global Spatial Robustness: Rotation-Translation (RT)-based Attacks The original RotationTranslation attack (Engstrom et al., 2017; 2019) applies parameter equations constraint on the 2D coordinate, thus capturing the global spatial information:[
u′ v′
] = [ cos θ − sin θ sin θ cos θ ] · [ u v ] + [ δu δv ] . (4)
To design a generic spatial transformation matrix that can simultaneously consider rotation, translation, cropping and scaling, we re-parameterize the transform matrix as a generic 6-dimensional affine transformation matrix, inspired by (Jaderberg et al., 2015):[
u′ v′
] = ( [ 1 0 0 0 1 0 ] + [ w11RT w 12 RT w 13 RT
w21RT w 22 RT w 23 RT
] ) · [ u v 1 ] , (5)
where we denote AwRT as the generic 6-dimensional affine transformation matrix, in which each wRT indicates the increment on different spatial aspects. For example, (w13RT , w 23 RT ) determines the translation. Finally, the optimization form of the resulting generic and differentiable RT-based attack bounded by RT -ball is exhibited as:
w∗RT = arg max wRT LCEθ (xwRT , y) s.t. ‖wRT ‖ ≤ RT . (6)
Integrated Spatial Robustness The key to achieve this goal is to design an integrated parameterized sampling grid TwRT ,wF (G) that can warp the regular grid with both affine and flow transformation, where G is the generated grid. We show our integrated approach as follows:
TwRT ,wF (G) = AwRT [ u v 1 ] + [ wF 1 ] ,
xadv = TwRT ,wF (G) ◦ x.
(7)
Then we sample new xadv by TwRT ,wF (G) via differentiable bilinear interpolation (Jaderberg et al., 2015). Then the loss function of the differentiable integrated spatial attack can be presented as:
w∗ = arg max w LCEθ (x+ ηw, y), s.t. ‖w‖ ≤ , (8)
where w = [wF , wRT ]T and ηw is the crafted integrated spatial perturbation. Note that ηw itself does not necessarily satisfy the lp constraint directly. For the implementation, we follow the PGD procedure (Madry et al., 2017), a common practice in sensitivity-based attacks. We consider the infinity norm of w and different learning rates for the two sorts of spatial robustness:[
wt+1F wt+1RT
] = [ wtF wtRT ] + [ αF αRT ] clip (sign(∇wLCEθ (xtwt , y))),
xt+1wt+1 = Twt+1 (G) ◦ x t wt ,
(9)
where we denote wt+1 = [wt+1F , w t+1 RT ] T and = [ F , RT ]T . From Figure 1, we can observe that our Integrated Spatial Attack can construct both local and global spatial transformations on images. Then, we visualize the loss surface under this Integrated Spatial Attack leveraging “filter normalization” (Li et al., 2018) as illustrated in Figure 2. It is worth noting that the highly nonconcave loss landscape with respect to only rotation and translation raised by (Engstrom et al., 2019) has been largely alleviated by considering both local and global spatial vulnerability, verifying the efficiency of our Integrated Spatial Attack.
Remote-look of Initial Landscape Close-look of Initial Landscape Landscape around the maxima example

heading: 3 RELATIONSHIPS BETWEEN SENSITIVITY AND SPATIAL ROBUSTNESS

heading: 3.1 RELATIONSHIPS
text: Based on the analysis above, next we focus on investigating the relationships between the strength of one specific robustness and other types of robustness. Firstly, we empirically explore these relationships through conducting thorough experiments on MNIST, CIFAR-10 and Caltech-256 datasets. By adversarially training multiple PGD (sensitivity-based) robust models with different iteration steps, we further test their Flow-based and RT-based spatial robustness via methods proposed above.
As shown in Figure 3, it turns out that Flow-based spatial robustness (red) measured by its robust test accuracy presents a steady ascending tendency across three datasets as the PGD robustness increases, while the trend of RT-based spatial robustness fluctuates conversely. It is worth noting that we test the accuracy on correctly classified test data for the considered model for a fair comparison. The trade-off between sensitivity-based and RT-based spatial robustness is consistent with previous conclusion (Kamath et al., 2020; Tramèr & Boneh, 2019), but it does not (even on the contrary) apply to Flow-based spatial robustness that delicately measures the local spatial sensitivity of an image. We provide the strong evidence from the perspective of representation in the next subsection.

heading: 3.2 EXPLANATION FROM THE VIEWPOINT OF SHAPE-BIAS REPRESENTATION
text: We go first with our brief conclusion: the sensitivity-based robustness corresponds to the shape-bias representation (Shi et al., 2020; Zhang & Zhu, 2019), indicating that sensitivitybased robust models rely more on global shape when making decisions rather than local texture. By contrast, the spatial robustness is associated with different representation strategies, serving as a significant supplement toward the comprehensive robust representation. To demonstrate this conclusion, we visualize the saliency maps of naturally trained, PGD, Flowbased and RT adversarially trained models on some randomly selected images on Caltech-256 exhibited in Figure 4. Specifically, visualizing the saliency maps aims at assigning a sensitivity value, sometimes also called “attribution”, to show the sensitivity of the output to each pixel of an input image. Following (Shi et al., 2020;
Zhang & Zhu, 2019), we leverage SmoothGrad (Smilkov et al., 2017) to calculate saliency map S(x):
S(x) = 1
n n∑ i=1 ∂fyθ (xi) ∂xi . (10)
Figure 4 manifests that PGD trained models tend to learn a scarce and shape-biased representation among all pixels of an image, while two types of spatially adversarially trained models suggest converse representation. In particular, the resulting representation from the Flow-based training model has the tendency towards a shape-biased one as it places extreme values on the pixels around the shape of objects, e.g., the edge between the horse and the background shown in Flow AT in Figure 4. On the contrary, RT-based models have less reliance on the shape of objects, and at the meantime, the saliency values tend to be dense, scattering around more pixels of an image. Quantitatively, we calculate the distance of saliency maps from different models across all test data on Caltech-256 dataset, and then compute their skewness shown in Figure 5.
Specifically, we compute the pixel-wise distance between the saliency map of a robust model and that from a considered model, and then we calculate the median of skewness of the saliency map difference among all test data. Note that if two saliency maps have no difference, then the difference values will be a normal distribution with skewness 0. A negative skewness indicates that the original saliency map (representation) tends to be sparse compared with a considered model. We plot the tendency of skewness as the strength of some specific robustness increases shown in Figure 5. Based on the observations in Figure 5, we summarize the following conclusions:
1) Based on the first and forth sub-pictures, both PGD and Flow-based robust models tend to learn a sparse and shape-biased representation compared with the natural model, but the Flow-based trained model is less sparse or shape-biased in comparison with the PGD trained one. 2) On the contrary, RT-based robust models have the trend to learn a dense representation, which is also intuitive as the RT trained model is expected to memorize broader pixel locations to cope with potential rotation and transformation in the test data. The fundamental representation discrepancy of RT-based and sensitivity-based robustness provides deep insights to explain why the trade-off of these two robustness occurs. In the Appendix A.4, we provide a sketch map that better illustrates their relationships.

heading: 4 PARETO ADVERSARIAL ROBUSTNESS WITH PARETO FRONT

heading: 4.1 MOTIVATION
text: Pareto Optimization. Based on the aforementioned analysis on the relationships between natural accuracy and different kinds of adversarial robustness, a natural question is how to design a training strategy that can perfectly balance their mutual impacts, which mainly sources from their different representation manners. In particular, in most cases their relationships reveal trade-off ones, except when the sensitivity robustness increases, Flow-based spatial robustness is enhanced. To better address these competing optimization objectives, we introduce Pareto optimization (Kim & De Weck, 2005; Lin et al., 2019), and the resulting Pareto front, the set of Pareto optimal solutions, can offer valuable trade-off information between objectives. We provide more background information about Pareto optimization in Appendix A.5.
Limitation of Existing Strategies. Given perturbation sets Si, i = 1, ...,m, and its corresponding adversarial risk Radv(f ;Si) := E(x,y)∼D [maxr∈Si L(f(x+ r), y)], our goal is to find fθ that can achieve the uniform risk minimization across all Si as well as the minimal risk in the natural data. 1) Average adversarial training (Ave AT) (Tramèr & Boneh, 2019), i.e., Rave(f ;S) := E(x,y)∼D [ 1 m ∑m i=1 maxr∈Si L(f(x+ r), y) ] , regards each adversarial robustness as the equal status. It may yield unsatisfactory solutions when the strength of different attacks mixed in training are not balanced, which we demonstrate in our experiments. 2) Max adversarial training (Max AT) (Tramèr & Boneh, 2019; Maini et al., 2019), i.e., Rmax(f ;S) := E(x,y)∼D[maxi{maxr∈Si L(f(x + r), y)}] may overfit to specific type of adversarial robustness if its adversarial attack used for training is too strong. Figure 6 demonstrates that as the strength of PGD attack used in Max AT increases, the comprehensive robustness of Max AT degenerates to a single PGD adversarial training, owing to the fact that the PGD loss tends to dominate among
all losses. Appendix A.6 provides more details about Figure 6 and also introduces Proposition 2 to illuminate that Max AT is also closely linked with specific weights of Ave AT.

heading: 4.2 PARETO ADVERSARIAL ROBUSTNESS AND PARETO ADVERSARIAL TRAINING
text: The key to Pareto adversarial robustness is to find the optimal combination (trade-off in most cases) between natural accuracy, sensitivity-based and spatial robustness. Specifically, we hope to compute optimal α in the following formula:
min θ,α Lθ = α0Lnat + α1LPGD + α2LFlow + α3LRT, (11)
where α = (α0, α1, α2, α3) and Lθ is the cross entropy loss based on the integrated framework we previously analyzed. Lnat,LPGD,LFlow and LRT represent the natural loss, the PGD adversarial loss, the Flow-based and the RT-based adversarial loss, respectively. Note that we additionally introduce natural loss to guarantee a high-level natural accuracy (Raghunathan et al., 2020). However, direct joint minimization over Eq. 11 will degenerate to the trivial solution and the introduction of validation dataset to tune α, e.g., DARTS (Liu et al., 2018), is also computationally expensive for the adversarial training with multiple iterations. To avoid these, our approach is to introduce the Pareto criteria to choose optimal α to balance the mutual impacts between different adversarial robustness. Specifically, based on Eq 11, we additionally introduce the two-moment term regarding all losses into a bi-level optimization framework, in order to compute the optimal combination α during the whole training process. We name this bi-level optimization approach as Pareto Adversarial Training, and the lower-level optimization regarding α can be formulated as follows:
min α 3∑ i=0 3∑ j=0 Ex(αiLi − αjLj)2 s.t. 3∑ i=1 αiEx(Li) = r, 3∑ i=0 αi = 1, αi ≥ 0,∀i = 0, 1, 2, 3,
(12) where L0,L1,L2,L3 represent Lnat,LPGD,LFlow,LRT respectively for simplicity, sharing the same model parameter θ. r indicates the expectation of one-moment over all robust losses, i.e., spatial and sensitivity-based losses, which reflects the strength of comprehensive robustness we require after solving this quadratic optimization. In particular, given the fixed Ex(Li) following the updating of θ based on Eq. 11, the larger r we require will push the resulting αi, i = 1, 2, 3 larger as well, thus putting more weights on the robust losses while the whole process of Pareto Adversarial Training. For the understanding of the two-moment objective function, firstly we regard all losses as random variables with its stochasticity arising from the mini-batch sampling from data. The weighted quadratic difference is to measure the trade-off within natural accuracy and various robustness, and then the minimization is to alleviate this mutual trade-off under certain constraints. In addition, we leverage sliding windows technique to compute the expectation and CVXOPT tool to
solve this quadratic optimization within each mini-batch training. Overall, for the upper level optimization in our bi-level Pareto adversarial training method, we leverage our familiar SGD method to update θ in Eq. 11 with α calculated from the lower level problem. In the lower level procedure, we solve the quadratic optimization regarding α to obtain the optimal combination among natural loss, sensitivity-based and spatial adversarial loss. We provide the proof about the quadratic formulation in Eq. 12 and our algorithm description in Appendix A.7.

heading: 4.3 PARETO FRONT IN EMPIRICAL STUDY
text: By adjusting the upper bound of expected adversarial robustness loss, i.e., r, we can evenly generate Pareto optimal solutions where the obtained models will have different levels of robustness under optimal combinations. The set of all Pareto optimal solutions then forms the Pareto front. Concretely, we train deep neural networks under different adversarial training strategies, and then evaluate their robustness by PGD, Flow-based and RT attacks, which we proposed previously, under different iteration steps. After equally averaging robust accuracy for each category of these attacks, we then compute the difference of robust accuracy between different training strategies and standard training, attaining Robustness Score to evaluate the comprehensive robustness of all adversarial training strategies. Finally, we plot the Robustness Score and sacrificed clean accuracy of all methods across three datasets in Figure 7. Experimental details can be found in Appendix A.8.
The Pareto criterion (Appendix A.5) exhibited in Figure 7 can be interpreted that Pareto Adversarial Training can achieve the best comprehensive robustness compared with other training strategies, given a certain level of sacrificed clean accuracy we can tolerate. By adjusting the different levels of expected comprehensive robustness r in Pareto Adversarial Training, we can develop the set of Pareto optimal solutions, i.e., the Pareto front. It manifests that all other methods are above our Pareto front, thus lacking effectiveness compared with our proposal. Overall, our proposed Pareto Adversarial Training develops an optimal (Pareto) criterion, by which we can maintain the optimal balance among the mutual impacts of natural accuracy and different robustness, based on the deep understanding of their relationships.

heading: 5 DISCUSSION AND CONCLUSION
text: The essential purpose of our work is to design a novel approach towards comprehensive adversarial robustness. To achieve this goal, we firstly analyze the two main branches of spatial robustness and then integrate them into one framework. Based on that, we further investigate the thorough relationships between sensitivity-based and two distinct spatial robustness from the perspective of representation. More importantly, having understanding the mutual impacts of different kinds of adversarial robustness, we introduce Pareto criterion into adversarial training framework, yielding the Pareto Adversarial Training. The resulting Pareto front provides optimal performance under the Pareto Criterion over existing baselines. In the future, we hope to apply Pareto analysis into more general Out-of-Distribution generalization settings.

Review summaries:
This paper first studies the tradeoffs between two forms of spatial robustness, including robustness against Flow-based spatial attack and Rotation-Translation (RT) attack. In particular, it proposes an approach to account for both local and global spatial transformations in an integrated framework. In addition, the paper investigates the relationship between the sensitivity-based (lp-norm based) and spatial robustness, and proposes a training method called ‘Pareto Adversarial Training’ to find optimal combination between natural accuracy, sensitivity-based and spatial robustness.

This paper first provides explanations to the inherent tradeoff between rotation adversarial attack and sensitivity attacks/spatial transform attacks, through their differences in saliency maps. Further, the authors proposed to utilize pareto training to find the best tradeoff among the four dimensions: natural accuracy, robustness against sensitivity/rotation/spatial transformation attacks. Experimental results show the proposed pareto adversarial training achieves better tradeoff between clean accuracy and adversarial robustness averaged across three types of attacks.