Reducing Excessive Margin to Achieve a Better Accuracy vs. Robustness Trade-off

1 INTRODUCTION Despite the remarkable success of modern deep networks on computer vision tasks , they are notoriously fragile to small , imperceptible changes in the input data ( Szegedy et al. , 2014 ) . Ever since the introduction of ` p-norm based adversaries ( Goodfellow et al. , 2015 ; Moosavi-Dezfooli et al. , 2016 ) , a growing body of researchers has focused on developing solutions for improving the robustness of DNNs . At present , adversarial training ( Madry et al. , 2018 ) remains the most effective approach for robustification . Nevertheless , it is known to cause an undesirable reduction in accuracy , thus leading to the much-debated trade-off between accuracy and robustness ( Tsipras et al. , 2019 ; Yang et al. , 2020 ) . Subsequently , in an endeavour to alleviate the accuracy vs. robustness trade-off , several refinements have been proposed to the vanilla adversarial training , e.g. , Zhang et al . ( 2019 ) ; Wang et al . ( 2020 ) ; Rice et al . ( 2020 ) ; Wu et al . ( 2020 ) ; Zhang et al . ( 2021 ) . However , as shown in Fig . 1 , the progress has been rather incremental over the last few years . Notwithstanding these recent advances , closing the large gap between accuracy and robustness still remains an open challenge and every modest improvement in this regard remains significant for the practitioners . In this paper , we take a step towards demystifying and improving the aforementioned trade-off . To this end , we take a closer look at the effect of training with adversarial examples on the geometry of decision boundaries learnt by deep networks . Specifically , relying on the perspective proposed by Ortiz-Jimenez et al . ( 2020 ) which relates the directional margin with the discriminative features used by a network , we uncover an unwanted consequence of adversarial training . That is , we identify that adversarial training leads to a superfluous increase in the margin along the adversarial directions of the input space computed for a regularly trained network . We refer to these directions as initial adversarial directions1 . In other words , the network becomes excessively robust ( compared to the attack radius ε ) along the directions which are otherwise pivotal for regular networks , and hence the accuracy drops . Further , we establish an empirical connection between the margin along initial adversarial directions and the classification performance of the network . In particular , a smaller margin along these directions corresponds to a higher accuracy . Thus , while the excessive margin is not essential for robustness , it severely derails the performance on clean samples . This naturally raises the following question : Can we foresee an improvement in accuracy by reducing the margin along initial adversarial directions while preserving the same level of robustness ? To address this question , we propose a heuristic adversarial training scheme to reduce the directional margin and thus , achieve a better accuracy without sacrificing robustness . We call this algorithm , Helper-based Adversarial Training ( HAT ) , the name derived from the fact that we incorporate additional training examples comprising of overly perturbed adversarial images ( possibly ) wrongly labelled using a standard trained network to help impede excessive directional robustness and hence , improve clean accuracy ( see Fig . 2 ) . We also provide an extensive analysis of HAT and compare it with state-of-the-art AT methods . The main contributions of this paper include : • We demonstrate that adversarial training leads to a large margin along initial adversarial directions . In addition , we identify a direct connection between the excessive margin and the reduction in clean accuracy caused by adversarial training . • We propose Helper-based Adversarial Training ( HAT ) to explicitly reduce the excessive margin by augmenting the training data with properly-labelled helper examples . • Experimentally , we show that HAT consistently improves accuracy without sacrificing robustness . Notably , in combination with recent improvements from Rebuffi et al . ( 2021 ) , HAT sets a new state-of-the-art and improves clean accuracy by 3.33 % on CIFAR-10 and 4.63 % on CIFAR-100 using PreAct ResNet-18 against ` ∞ perturbations of size 8/255 . 1.1 RELATED WORK . Improving adversarial robustness . To mitigate the adversarial susceptibility of DNNs , a myriad of defense methodologies ( Papernot et al. , 2016 ; Tramèr et al. , 2018 ; Kannan et al. , 2018 ; Wang et al. , 2019 ; Xiao et al. , 2020 ) have been proposed . Yet , many of them have been shown to provide superficial robustness by introducing gradient obfuscation ( Athalye et al. , 2018 ) , hence calling for a cautious evaluation of robustness ( Tramer et al. , 2020 ; Croce et al. , 2020 ) . Nonetheless , adversarial training ( AT ) ( Madry et al. , 2018 ) or training with worst-case inputs has been the most popular approach for improving the robustness of DNNs albeit at the cost of a sizeable drop in accuracy . Notably , AT has been able to withstand newer sophisticated adversaries ( Gowal et al. , 2019 ; Croce & Hein , 2020 ) . Another prominent defense is TRADES ( Zhang et al. , 2019 ) , which provides a systematic way to control the trade-off between accuracy and robustness by solving : argmin θ n∑ i=1 CE ( yi , fθ ( xi ) ) + β max δi : ||δi||p≤ε KL ( fθ ( xi ) , fθ ( xi + δi ) ) , ( 1 ) 1The reason for such terminology will become clear in the later sections . where CE is the cross-entropy loss , KL is the Kullback-Leibler divergence and β controls the trade-off between accuracy and robustness . More recent attempts to improve the accuracy vs. robustness trade-off have predominantly dealt with refining adversarial training by ( i ) modifying the objective function ( Wang et al. , 2020 ; Zhang et al. , 2020 ; 2021 ) , ( ii ) early-stopping ( Rice et al. , 2020 ) , ( iii ) heuristics and hyperparameter selection ( Pang et al. , 2021 ; Gowal et al. , 2021 ) , ( iv ) extra data ( Hendrycks et al. , 2019 ; Alayrac et al. , 2019 ; Carmon et al. , 2019 ; Rebuffi et al. , 2021 ; Sehwag et al. , 2021 ) , and ( v ) weight initialization for training with large perturbations ( Shaeiri et al. , 2020 ) . Despite these advancements , the problem is far from being solved with a huge gap between accuracy and robustness on practical image recognition benchmarks . We revisit this issue in our paper and build upon TRADES to further ameliorate the trade-off . Understanding adversarial vulnerability . A concurrent stream of prior works has provided plausible reasons for the existence of adversarial examples . Adversarial vulnerability of DNNs has been accredited to the existence of highly generalizable , but non-robust features in the data which are exploited by DNNs to achieve state-of-the-art performance ( Jetley et al. , 2018 ; Ilyas et al. , 2019 ) . Besides , Ortiz-Jimenez et al . ( 2020 ) devised a novel experimental framework which relates the distance of data points to the decision boundary of a DNN with the discriminative features used by the DNN in order to understand the mechanism behind AT . 2 PRELIMINARIES . Consider the input space X ⊆ Rd . Let fθ : X → RC represent a deep neural network classifier parameterized by θ , where C is the number of output classes . Let Fθ ( x ) = argmaxk fθ ( x ) k be the class label predicted by fθ for any x ∈ X , where fθ ( x ) k is the kth component of fθ ( x ) . Margin . Given a classifier Fθ , input x and an unit vector r̂ ∈ Sd−1 , we define margin µ at x along the direction r̂ as : µ ( x , r̂ ) = argmin α |α| s.t . Fθ ( x+ αr̂ ) 6= Fθ ( x ) ( 2 ) Additionally , note that we refer to a deep network trained only on clean samples as standard network and a network trained via adversarial training as robust network . Besides , we reuse the definitions of clean ( natural ) and robust ( adversarial ) accuracy as stated by Zhang et al . ( 2019 ) . Initial adversarial directions . Given a standard network fθ , input dataset { ( xi , yi ) } ni=1 , we define the set of initial adversarial directions asRinit = { ri/||ri||2 } ni=1 where ri is obtained by solving : ri = max δi : ||δi||p≤ε ` ( yi , fθ ( xi + δi ) ) . ( 3 ) where , ` ( · , · ) is an arbitrary loss function e.g . cross-entropy ( CE ) . This optimization is usually solved via a multi-step procedure called projected gradient descent ( PGD ) ( Madry et al. , 2018 ) . 3 ADVERSARIAL TRAINING INTRODUCES EXCESSIVE INVARIANCE . We begin our analysis by examining the effect of adversarial training ( AT ) on the decision boundary of DNNs . Via novel analysis on a synthetic dataset and CIFAR-10 ( Krizhevsky , 2009 ) , we show that AT triggers a superfluous increase in the margin along the initial adversarial directions as compared to the nominal increase required to attain robustness . In addition , we provide empirical evidence which signifies a connection between the increase in margin and reduction in clean accuracy . Toy problem . First , we study a toy setting to shed some light on the phenomenon of excessive directional margin caused by AT . We construct a 3-d binary classification dataset drawn from two distributions which live on two noisy concentric circles of different radii in the x1-x2 plane and being linearly separable along the third dimension x3 . In particular , x1 = ρi cos ( z ) + 1 , x2 = ρi sin ( z ) + 2 and x3 ∼ U ( αi , βi ) where z ∼ U ( 0 , 2π ) and 1 , 2 ∼ N ( 0 , σ2 ) where i = 1 , 2 for class 1 and 2 respectively . We train a single hidden-layer MLP via both standard training and adversarial training . Fig . 3 visualizes the decision regions with both the training procedures . It is evident that the network primarily uses x3 to achieve zero classification error when trained using standard training , but the resulting model performs poorly in terms of robustness . In contrast , when we use AT , the learned decision boundary is completely different from that in the standard case . Here , the network becomes reasonably invariant along x3 ( Fig . 3b ) , thus causing the directional margin along x3 to tend to∞ . This enables the network to attain robustness at the cost of a small increase in classification error . Evidence on CIFAR-10 . Next , we illustrate that a similar phenomenon occurs in the case of stateof-the-art deep networks trained on CIFAR-10 . To this end , we measure directional margin ( as defined by Eq . 2 ) to the classification boundary which allows us to partly capture the geometry of decision boundary . We restrict ourselves to the following setting . We take a ResNet-18 ( He et al. , 2016 ) trained until convergence on CIFAR-10 ( achieving 94.6 % accuracy and 0 % robustness to ` ∞- PGD perturbations on the test set ) and then fine-tune it using AT with adversarial examples . This framework allows us to study the evolution of the decision boundary caused by AT in comparison to that learnt by a standard network . We use ` ∞-PGD with norm ε = 8/255 for training . The network attains 83.3 % accuracy and 51.6 % robustness on the test set after adversarial fine-tuning . Please refer to App . B.1 for more details of the experimental setup . Meanwhile , during adversarial fine-tuning , we track the margins along the adversarial directions found by PGD to shed some light on the learning dynamics . SupposeRk = { rki /||rki ||2 } , where rki denotes adversarial perturbation found by PGD at kth epoch of adversarial fine-tuning for the input sample xi . Thus , Rinit = R0 represents the set of initial adversarial directions . We hypothesize that during adversarial training , the network becomes excessively robust to these initial adversarial directions R0 while slightly shifting the decision boundaries along other adversarial directions Rk≥1 . Fig . 4 illustrates the margins along R0 , R1 and R5 before and after adversarial fine-tuning respectively . The dashed red line indicates the value of ε used for training , i.e. , any allowable pertur- bation r has ||r||∞ ≤ 8/255 or equivalently ||r||2 ≤ 1.74 . Intuitively , one might expect adversarial fine-tuning to cause small shifts in the decision boundary so that the margin becomes greater than 1.74 , and attain robustness . However , this is not the case in practice . Intriguingly , the classifier instead resorts to becoming largely insensitive along R0 for some data points as evident in Fig . 4 while undergoing small shifts along other directionsRk≥1 . We also observe a decrease of 11.3 % in clean accuracy after fine-tuning . Connection between margin alongRinit and clean accuracy . We now provide a two-fold argument which justifies the following hypothesis : ” The drastic rise in the margin alongRinit is directly correlated to the observed reduction in accuracy ” . In fact , a larger margin contributes to a larger drop in accuracy . ( i ) Firstly , we complement our hypothesis with the following observation by Ortiz-Jimenez et al . ( 2020 ) . The directions of input space with small margins and in turn , the initial adversarial directions in the case of standard network , are associated with discriminative features learnt by the network . We believe that these directions are crucial for the performance of the network . Thus , a drastic directional margin along these directions contributes to the drop in classification accuracy . ( ii ) We train a robust network on CIFAR10 using TRADES with different values for the trade-off parameter β . ( Please refer to Sec . 5.1 for the exact experimental setup . ) As β increases , we observe an increase in the margin along Rinit ( computed on a subset of 1024 examples from the CIFAR-10 test set ) and a corresponding reduction in clean accuracy ( see Table 1 ) . This further corroborates our hypothesis .

Summary: The paper highlights the presence of excessive invariance in the prediction of robust models along the initial adversarial directions. Initial adversarial directions refers to the directions in which adversarial images generated using a standard trained model are present. Based on this hypothesis the authors propose a training method where the excessive invariance is minimized using the cross entropy loss between the prediction(made using the standard trained model) of larger epsilon adversarial image and the prediction of the adversarial image, in addition to the TRADES loss formulation. This additional loss term indeed improves the accuracy-robustness trade-off by giving a significant boost in clean accuracy along with a slight boost in adversarial robustness as compared to the existing methods. Overall the paper is well written and easy to follow.