PARL: Enhancing Diversity of Ensemble Networks to Resist Adversarial Attacks via Pairwise Adversarially Robust Loss Function

1 INTRODUCTION . Deep learning ( DL ) algorithms have seen rapid growth in recent years because of their unprecedented successes with near-human accuracies in a wide variety of challenging tasks starting from image classification ( Szegedy et al. , 2016 ) , speech recognition ( Amodei et al. , 2016 ) , natural language processing ( Wu et al. , 2016 ) to self-driving cars ( Bojarski et al. , 2016 ) . While DL algorithms are extremely efficient in solving complicated decision-making tasks , they are vulnerable to well-crafted adversarial examples ( slightly perturbed valid input with visually imperceptible noise ) ( Szegedy et al. , 2014 ) . The widely-studied phenomenon of adversarial examples among the research community has produced numerous attack methodologies with varied complexity and effective deceiving strategy ( Goodfellow et al. , 2015 ; Kurakin et al. , 2017 ; Madry et al. , 2018 ; Moosavi-Dezfooli et al. , 2016 ; Papernot et al. , 2017 ) . An extensive range of defenses against such attacks has been proposed in the literature , which generally falls into two categories . The first category enhances the training strategy of deep learning models to make them less vulnerable to adversarial examples by training the models with different degrees of adversarially perturbed training data ( Bastani et al. , 2016 ; Huang et al. , 2015 ; Jin et al. , 2015 ; Zheng et al. , 2016 ) or changing the training procedure like gradient masking , defensive distillation , etc . ( Gu & Rigazio , 2015 ; Papernot et al. , 2016 ; Rozsa et al. , 2016 ; Shaham et al. , 2015 ) . However , developing such defenses has been shown to be extremely challenging . Carlini & Wagner ( 2017b ) demonstrated that these defenses are not generalized for all varieties of adversarial attacks but are constrained to specific categories . The process of training with adversarially perturbed data is hard , often requires models with large capacity , and suffers from significant loss on clean example accuracy . Moreover , Athalye et al . ( 2018 ) demonstrated that the changes in training procedures provide a false sense of security . The second category intends to detect adversarial examples by simply flagging them ( Bhagoji et al. , 2017 ; Feinman et al. , 2017 ; Gong et al. , 2017 ; Grosse et al. , 2017 ; Metzen et al. , 2017 ; Hendrycks & Gimpel , 2017 ; Li & Li , 2017 ) . However , even detection of adversarial examples can be quite a complicated task . Carlini & Wagner ( 2017a ) illustrated with several experimentations that these detection techniques could be efficiently bypassed by a strong adversary having partial or complete knowledge of the internal working procedure . While all the approaches mentioned above deal with standalone classifiers , in this paper , we utilize the advantage of an ensemble of classifiers instead of a single standalone classifier to resist adversarial attacks . The notion of using diverse ensembles to increase the robustness of a classifier against adversarial examples has recently been explored in the research community . The primary motivation of using an ensemble-based defense is that if multiple classifiers with similar decision boundaries perform the same task , the transferability property of DL classifiers makes it easier for an adversary to mislead all the classifiers simultaneously using adversarial examples crafted on any of the classifiers . However , it will be difficult for an adversary to mislead multiple classifiers simultaneously if they have diverse decision boundaries . Strauss et al . ( 2017 ) used various ad-hoc techniques such as different random initializations , different neural network structures , bagging the input data , adding Gaussian noise while training for creating multiple diverse classifiers to form an ensemble . The resulting ensemble increases the robustness of the classification task even in the presence of adversarial examples . Tramèr et al . ( 2018 ) proposed Ensemble Adversarial Training that incorporates perturbed inputs transferred from other pre-trained models during adversarial training to decouple adversarial example generation from the parameters of the primary model . Grefenstette et al . ( 2018 ) demonstrated that ensembling two models and then adversarially training them incorporates more robustness in the classification task than single-model adversarial training and ensemble of two separately adversarially trained models . Kariyappa & Qureshi ( 2019 ) proposed Diversity Training of an ensemble of models with uncorrelated loss functions using Gradient Alignment Loss metric to reduce the dimension of adversarial sub-space shared between different models and increase the robustness of the classification task . Pang et al . ( 2019 ) proposed Adaptive Diversity Promoting regularizer to train an ensemble of classifiers that encourages the non-maximal predictions in each member in the ensemble to be mutually orthogonal , which degenerates the transferability that aids in resisting adversarial examples . Yang et al . ( 2020 ) proposed a methodology that isolates the adversarial vulnerability in each sub-model of an ensemble by distilling non-robust features . While all these works attempt to enhance the robustness of a classification task even in the presence of adversarial examples , Adam et al . ( 2018 ) proposed a stochastic method to add Variational Autoencoders between layers as a noise removal operator for creating combinatorial ensembles to limit the transferability and detect adversarial examples . In order to enhance the robustness of a classification task and/or to detect adversarial examples , the ensemble-based approaches mentioned above employ different strategies while training the models . These ensembles either lack end-to-end evaluations for complicated datasets or lack evaluation against more aggressive attack scenarios like the methods discussed by Dong et al . ( 2018 ) and Liu et al . ( 2017 ) , which demonstrate that adversarial examples misleading multiple models in an ensemble tend to be more transferable . In this work , our primary objective is to propose a systematic approach to enhance the classification robustness of an ensemble of classifiers against adversarial examples by developing diversity in the decision boundaries among all the classifiers within that ensemble . The diversity is obtained by simultaneously considering the mutual dissimilarity in gradients of each layer with respect to input in every classifier while training them . The diversity among the classifiers trained in such a way helps to degenerate the transferability of adversarial examples within the ensemble . Motivation behind the Proposed Approach and Contribution : The intuition behind developing the proposed ensemble methodology is discussed in Figure 1 , which shows a case study using classifiers trained on CIFAR-10 dataset without loss of generality . Figure 1a shows an input image of a ‘ frog ’ . Figure 1b shows the gradient of loss with respect to input1 in a classifier Mprim , and denoted as ∇prim . Figure 1c shows the gradient for another classifier Msim with a similar decision boundary as Mprim , and denoted as ∇sim . The classifier Msim is trained using the same parameter settings asMprim but with different random initialization . Figure 1d shows the gradients for a classifierMdiv with a not so similar decision boundary compared toMprim , and denoted as 1Fundamental operation behind the creation of almost all adversarial examples ∇div . The classifiersMprim , Msim , andMdiv have similar classification accuracies . The method for obtaining such classifiers is discussed later in this paper . Figure 1e shows relative symbolic directions among all the aforementioned gradients in higher dimension . The directions between a pair of gradients are computed using cosine similarity . We can observe that ∇prim and ∇sim lead to almost in the same directions , aiding adversarial examples crafted on Mprim to transfer into Msim . However , adversarial examples crafted inMprim will be difficult to transfer intoMdiv as the directions of∇prim and ∇div are significantly different . The principal motivation behind the proposed methodology is to introduce a constraint for reducing the cosine similarity of gradients among each classifier in an ensemble while training them simultaneously . Such a learning strategy with mutual cooperation intends to ensure that gradients between each pair of classifiers in the ensemble are as dissimilar as possible . We make the following contributions using the proposed ensemble training method : • We propose a methodology to increase diversity in the decision boundaries among all the classifiers within an ensemble to degrade the transferability of adversarial examples . • We propose a Pairwise Adversarially Robust Loss ( PARL ) function by utilizing the gradients of each layer with respect to input of every classifier within the ensemble simultaneously for training them to produce such varying decision boundaries . • The proposed method can significantly improve the overall robustness of the ensemble against black-box transfer attacks without substantially impacting the clean example accuracy . • We evaluated the robustness of PARL with extensive experiments using two standard image classification benchmark datasets on ResNet20 architecture against state-of-the-art adversarial attacks . 2 THREAT MODEL . We consider the following two threat models in this paper while generating adversarial examples . • Zero Knowledge Adversary ( AZ ) : The adversaryAZ does not have access to the target ensemble MT but has access to a surrogate ensembleMS trained with the same dataset . We term AZ as a black-box adversary . The adversaryAZ crafts adversarial examples onMS and transfers toMT . • Perfect Knowledge Adversary ( AP ) : The adversary AP is a stronger than AZ who has access to the target ensembleMT . We term AP as a white-box adversary . The adversary AP can generate adversarial examples onMT knowing the parameters used by all the networks withinMT . 3 OVERVIEW OF THE PROPOSED METHODOLOGY . In this section , we provide a brief description of the proposed methodology used in this paper to enhance classification robustness against adversarial examples using an ensemble of classifiersMT . The ensemble consists of N neural network classifiers and denoted asMT = ⋃N i=1Mi . All the Mi ’ s are trained simultaneously using the Pairwise Adversarially Robust Loss ( PARL ) function , which we discuss in detail in Section 4 . The final decision for an input image onMT is decided based on the majority voting among all the classifiers . Formally , let us assume a test set of t inputs { x1 , x2 , . . . , xt } with respective ground truth labels as { y1 , y2 , . . . , yt } . The final decision of the ensembleMT for an input xj is defined as C ( MT , xj ) = majority { M1 ( xj ) , M2 ( xj ) , · · · , MN ( xj ) } C ( MT , xj ) = yj for most xj ’ s in an appropriately trainedMT . The primary argument behind the proposed ensemble method is that allMi ’ s have dissimilar decision boundaries but not significantly different accuracies . Hence , a clean example classified as class Cx in Mi will also be classified as Cx in most otherMj ’ s ( where j = 1 . . .N , j 6= i ) within the ensemble with a high probability . Consequently , because of the diversity in decision boundaries betweenMi andMj ( for i = 1 . . .N , j = 1 . . .N , and i 6= j ) , the adversarial examples generated by a zero knowledge adversary ( AZ ) for a surrogate ensembleMS will have a different impact on each classifiers within the ensembleMT , i.e. , the transferability of adversarial examples will be challenging within the ensemble . A perfect knowledge adversary ( AP ) can generate adversarial examples for the ensembleMT . However , in this scenario , the input image perturbation will be in different directions because of the diversity in decision boundaries among allMi ’ s within the ensemble . The collective disparity in perturbation directions makes it challenging to craft adversarial examples for the ensemble . We evaluated our proposed methodology considering both the adversaries and presented the results in Section 5 .

Summary: The paper proposes a new method to train ensembles of classifiers which are robust to adversarial attacks, in particular black-box transfer-based ones. This is achieved by enforcing the output of early layers of different members of the ensemble to have, on average, gradients with low cosine similarity, which should in turn create different decision boundaries. For this, the authors design a specific loss function, PARL, to be minimized at training time. In the experiments, PARL models achieve higher robustness to transfer attacks that existing methods.