Manifold Regularization for Locally Stable Deep Neural Networks

1 INTRODUCTION . Recent results in deep learning highlight the remarkable performance deep neural networks can achieve on tasks using data from the natural world , such as images , video , and audio . Though such data inhabits an input space of high dimensionality , the physical processes which generate the data often manifest significant biases , causing realistic inputs to be sparse in the input space . One way of capturing this intuition is the manifold assumption , which states that input data is not drawn uniformly from the input space , but rather supported on some smooth submanifold ( s ) of much lower dimension . Starting with the work of Belkin et al . ( 2006 ) , this formulation has been studied extensively in the setting of semi-supervised kernel and regression methods , where algorithms exploit the unlabelled data points to learn functions which are smooth on the input manifold ( Geng et al. , 2012 ; Goldberg et al. , 2008 ; Niyogi , 2013 ; Sindhwani et al. , 2005 ; Tsang and Kwok , 2007 ; Xu et al. , 2010 ) . Such techniques have seen less use in the context of deep neural networks , owing in part to the ability of such models to generalize from relatively sparse data ( Zhang et al. , 2016 ) . Contributions We apply concepts from manifold regularization to train locally stable deep neural networks . In light of recent results showing that neural networks suffer widely from adversarial inputs ( Szegedy et al. , 2013 ) , our goal is to learn a function which does not vary much in the neighborhoods of natural inputs , independently of whether the network classifies correctly . We show that this definition of local stability has a natural interpretation in the context of manifold regularization , and propose an efficient regularizer based on an approximation of the graph Laplacian when the data is sparse , i.e. , the pairwise distances are large . Crucially , our regularizer exploits the continuous piecewise linear nature of ReLU networks to learn a function which is smooth over the data manifold in not only its outputs but also its decision boundaries . We evaluate our approach by training neural networks with our regularizers for the task of image classification on CIFAR-10 ( Krizhevsky et al. , 2009 ) . Empirically , our networks exhibit robustness against a variety of adversarial models implementing ` 2 , ` ∞ , and Wasserstein-based attacks . We also achieve state-of-the-art verified robust accuracy under ` ∞ of size = 8/255 . Furthermore , our regularizers are cheap : we simply evaluate the network at two additional random points for each training sample , so the total computational cost is on par with three parallel forward passes through the network . Our techniques thus present a novel , regularization-only approach to learning robust neural networks , which achieves performance comparable to existing defenses while also being an order of magnitude more efficient . 2 BACKGROUND . Manifold regularization The manifold assumption states that input data is not drawn uniformly from the input domain X , also know as the ambient space , but rather is supported on a submanifold M⊂ X , called the intrinsic space . There is thus a distinction between regularizing on the ambient space , where the learned function is smooth with respect to the entire input domain ( e.g. , Tikhonov regularization ( Phillips , 1962 ; Tikhonov et al. , 2013 ) ) , and regularizing over the intrinsic space , which uses the geometry of the input submanifold to determine the regularization norm . A common form of manifold regularization assumes the gradient of the learned function ∇Mf ( x ) should be small where the probability of drawing a sample is large ; we call such functions “ smooth ” . Let µ be a probability measure with supportM . This leads to the following intrinsic regularizer : ||f ||2I : = ∫ M ||∇Mf ( x ) ||2dµ ( x ) ( 1 ) In general , we can not compute this integral becauseM is not known , so Belkin et al . ( 2006 ) propose the following discrete approximation that converges to the integral as the number of samples grows : ||f ||2I ≈ 1 N2 N∑ i , j=1 ( f ( xi ) − f ( xj ) ) 2Li , j ( 2 ) Here , the x1 , ... , xN are samples drawn , by assumption , from the input manifoldM according to µ , and L is a matrix of weights measuring the similarity between samples . The idea is to approximate the continuous input manifold using a discrete graph , where the vertices are samples , the edge weights are distances between points , and the Laplacian matrix L encodes the structure of this graph . A common choice of weights is a heat kernel : Li , j = L ( xi , xj ) : = exp ( −||xi−xj ||2/s ) . To improve computational costs , weights are often truncated to the k-nearest neighbors or within some -ball . Note that the Laplacian can also be interpreted as a discrete matrix operator , which converges under certain conditions to the continuous Laplace operator ( Belkin and Niyogi , 2008 ) . ReLU networks Our development focuses on a standard architecture for deep neural networks : fully-connected feedforward networks with ReLU activations . In general , we can write the function represented by such a network with n layers and parameters θ = { Ai , bi } i=1 , ... , n−1 as z0 = x ( 3 ) ẑi = Ai · zi−1 + bi for i = 1 , ... , n− 1 ( 4 ) zi = σ ( ẑi ) for i = 1 , ... , n− 2 ( 5 ) f ( x ; θ ) = ẑn−1 ( 6 ) where the Ai are the weight matrices and the bi are the bias vectors . We call the zi “ hidden activations ” , or more simply , activations , and the ẑi “ pre-activations ” . In this work , we consider networks in which σ ( · ) in ( 5 ) is the Rectified Linear Unit ( ReLU ) zi = σ ( ẑi ) : = max ( 0 , ẑi ) ( 7 ) It is clear from this description that ReLU networks are a family of continuous piecewise linear functions . We denote the linear function induced by an input x as fx ( · ; θ ) , i.e. , the analytic extension of the local linear component about x over the input domain . Adversarial robustness One common measure of robustness for neural networks is against a norm-bounded adversary . In this model , the adversary is given an input budget over a norm || · ||in , and asked to produce an output perturbation δ over a norm | · |out . A point x′ is an -δ adversarial example for an input pair ( x , y ) if ||x′ − x||in ≤ ( 8 ) |f ( x′ ; θ ) − y|out ≥ δ ( 9 ) When the specific norm is either unimportant or clear from context , we also write the first condition as x′ ∈ N ( x ) , where N ( x ) refers to the -ball or neighborhood about x . If such an adversarial example does not exist , we say that the network is -δ robust at x . Standard examples of || · ||in include the ` 2 and ` ∞ “ norm ” , defined for vectors as ||x||∞ : = maxi |xi| . For classification tasks , the adversary is successful if it produces an example in the -neighborhood of x which causes the network to misclassify . In this case , we drop δ and say that the network is -robust at x . Note that if f ( x ; θ ) is already incorrect , then x suffices as an adversarial example . 3 RELATED WORK . Manifold regularization was first introduced by Belkin et al . ( 2006 ) in the context of semi-supervised learning , where the goal was to leverage unlabeled samples to learn a function which behaves well ( e.g. , is smooth , or has low complexity ) over the data manifold . The use of manifold regularization for deep neural networks has been explored in several contexts ( Tomar and Rose , 2014 ; 2016 ; Hu et al. , 2018 ; Zhu et al. , 2018 ) . In particular , Lee et al . ( 2015 ) combine manifold regularization with adversarial training and show improvements in standard test accuracy . Our approach is to use manifold regularization to induce stability separately from accuracy . We note that a similar decomposition between accuracy and stability forms the basis for the TRADES algorithm ( Zhang et al. , 2019 ) , though the training procedure ultimately relies on adversarial training . Hein and Andriushchenko ( 2017 ) propose a conceptually similar regularizer to minimize the difference between logits and show improved ` 2 certified robustness . Finally , several prior works explore regularizing for robustness based on other differential forms ( Ross and Doshi-Velez , 2017 ; Jakubovitz and Giryes , 2018 ) , though they only report results using the weaker single-step PGD adversary . In particular , a recent work by Zhai et al . ( 2020 ) uses randomized smoothing for ` 2 certified robustness , and claim similar computational advantage due to avoiding adversarial training , but still take 61 hours to train , compared to only 3 hours in our approach . Adversarial examples were introduced by Szegedy et al . ( 2013 ) , who found that naively trained neural networks suffer almost complete degradation of performance on natural images under slight perturbations which are imperceptible to humans . A standard class of defenses is adversarial training , which is characterized by training on adversarially generated input points ( Goodfellow et al. , 2014 ) . In particular , the Projected Gradient Descent ( PGD ) attack ( Kurakin et al. , 2016 ; Madry et al. , 2017 ) is widely considered to be an empirically sound algorithm for both training and evaluation of robust models . However , such training methods rely on solving an inner optimization via an iterative method , effectively increasing the number of epochs by a multiplicative factor ( e.g. , an overhead of 5–10x for standard PGD ) . Achieving robustness against multiple adversarial models has also been explored previously ( Schott et al. , 2018 ; Tramer and Boneh , 2019 ; Maini et al. , 2019 ; Croce and Hein , 2019b ) , though in most cases these works use weaker variants of the subset of standard adversaries we consider ( e.g. , a smaller or the single-step version of PGD ) . Another approach is to train models which are provably robust . One method is to use an exact verification method , such as an MILP solver , to prove that the network is robust on given inputs ( Tjeng et al. , 2017 ) . In particular , Xiao et al . ( 2019 ) use a similar loss based on ReLU pre-activations to learn stable ReLUs for efficient verification , but rely on a PGD adversary to train a robust model . Certification methods modify models to work directly with neighborhoods instead of points ( Dvijotham et al. , 2018 ; Gowal et al. , 2018 ; Mirman et al. , 2018 ; Wong et al. , 2018 ) . In practice , the inference algorithms must overapproximate the neighborhoods to preserve soundness while keeping the representation compact as it passes through the network . This strategy can be interpreted as solving a convex relaxation of the exact verification problem . Though certification thus far has produced better lower bounds , verification as a technique is fully general and can be applied to any model ( given sufficient time ) ; recent work also suggests that methods using layerwise convex relaxations may face an inherent barrier to tight verification ( Salman et al. , 2019 ) .

Summary: This work introduces manifold regularization as an approach for learning stable deep nets, towards the goal of adversarial robustness. Several regularizers are proposed: intrinsic, sparse Laplacian and Hamming regularizers. As the proposed method relies only on adding these regularization terms to the loss, it is more computationally efficient than methods that require computation of adversarial examples during training. The proposed method is evaluated on CIFAR-10 under $\ell_2$ and $\ell_{\infty}$ ball attacks and shown to be state-of-the-art in terms of verifiable robustness to $\ell_{\infty}$ attacks at $\epsilon = 8/255$.