Can standard training with clean images outperform adversarial one in robust accuracy?

1 INTRODUCTION . The seminal work of ( Goodfellow et al. , 2015 ) pointed out a surprising weakness of modern deep neural networks : although they can perform on par with human beings , their reliability is far from satisfaction . Almost imperceptibly added perturbations will be enough to mislead the network to output a wrong class label with high confidence . It will dramatically undermine the deployment of networks in some safety-critical applications : autonomous driving , image-based ID verification , and medical image analysis . Since then , researchers have heavily investigated this risk exposure and proposed different defense strategies . One direction is some prepossessing techniques such as bit-depth reduction ( Xu et al. , 2018 ) , JPEG compression , total variance minimization , image quilting ( Guo et al. , 2018 ) , and Defense-GAN ( Samangouei et al. , 2018 ) . The idea is to mitigate the effect of added noise and save the network to some extent . Unfortunately , ( Athalye et al. , 2018 ) showed that most of these approaches are based on obfuscated gradients and can be defeated . The other line of research adopts various adversarial training techniques where malicious examples are generated and fed to the network . A simple rationale behind this is if the network has this knowledge , it will become wise in test time . While there are different mechanisms such as Mixup inference ( Pang et al. , 2020 ) , feature scattering ( Zhang & Wang , 2019 ) , feature denoising ( Xie et al. , 2019 ) , geometry-aware instance reweighting ( Zhang et al. , 2021 ) , and channel-wise activation suppressing ( Bai et al. , 2021 ) , they all share the same philosophy . While people are astonished by the fact that imperceptibly added perturbations can fool the network , some theoretical works such as ( Tsipras et al. , 2019 ; Schmidt et al. , 2018 ) showed that it is not entirely unexpected . Unfortunately , there are no solutions without the awareness of attack models . Ideally , all defenses should be ignorant of this . However , this knowledge is essential to the adversarial training method that remains most effective , although at the cost of a large computation load . Now the big question arises : “ Can standard training with clean images outperform adversarial one in robust accuracy ? ” Here “ clean images ” means there is no manipulation of inputs even by adding some random noise such as ( Jin & Rinard , 2020 ) , although it is for manifold regularization rather than adversarial training . At first glance , it seems hopeless , as a widely accepted principle in the adversarial learning community is that a network can be clever only if it has been exposed to deceptions before . However , on the other hand , the networks are supposed to generalize well after standard training . How can it perform so badly for adversarial attacks ? As a possible answer to this , ( Ilyas et al. , 2019 ) investigated the cause of adversarial examples and concluded that neural networks tend to exploit predictive yet brittle features to make classifications . These features are incomprehensible to humans and thus can be modified by adversarial attackers to mislead the networks , but ( Ilyas et al. , 2019 ) did not show how to teach the network to disregard these non-robust features and discover the robust ones to make final decisions . From this perspective , as it is difficult to tell the network to learn robust features , what if we add some hints in the loss function and let the network become robust in an implicit way ? More specifically , in addition to the classical cross-entropy loss , we use a feature smoothing term that encourages the features in an intermediate layer to be uniform , as shown in the left of Figure 1 . It sounds counterintuitive as this term will constrain the space of features that may lead to a wrong classification . However , due to the high capacity of networks , a very high standard accuracy can still be achieved with this additional term . When training completes , given an input , whether clean or crafted , extra perturbations can always be created by some added random noise followed by the promotion of feature smoothing at the cost of reduced accuracy . So long as these intentional perturbations overweight the adversary ’ s and the reduction in accuracy is affordable , the model will become robust . We call this procedure Active Defense , as shown in the right of Figure 1 . We find experimentally , a clean example from CIFAR10/CIFAR-100 can be perturbed with l∞ = 25/255 ∼ 32/255 , three to four times of l∞ = 8/255 usually adopted by an adversary , yet be classified with a high success rate . This fact sets up the adequate space for Active Defense for eliminating the effects of attacks . Our approach is independent of any attack models compared with other state-of-the-art methods , and its performance is much more stable under attacks with different budgets . The contributions of this work are summarized as follows : • We propose a novel training scheme with an extra feature smoothing loss term that only takes clean images as inputs , fundamentally different from all existing adversarial training methods that need supplementary crafted data . •We present Active Defense that adds the second round of perturbations through random noise and feature smoothing . It modifies the malicious examples in a way that is friendly to the network . This deviates from conventional passive ones that keep the input intact . 2 RELATED WORKS . Due to adversarial threats to deep learning applications , there are many works to improve the robustness . Most of them adopt adversarial training . Among them , only a few take care of the features in intermediate layers as listed in the following . Feature denoising in ( Xie et al. , 2019 ) found that small perturbations in pixel space can lead to very substantial noise in the feature maps of the network and proposed various filters to denoise . ( Zhang & Wang , 2019 ) proposed to generate adversarial images for training through feature scattering in the latent space . In essence , perturbed images are produced collaboratively via optimal transport distance minimization . ( Zhang & Wang , 2019 ) used the feature maps as a guide to making new examples . Compared with these two , we are trying to force the intermediate feature map to be uniform through an additional loss term within the standard training framework without any modification of the network as in ( Xie et al. , 2019 ) or any other manipulations of features as in ( Zhang & Wang , 2019 ) . Regarding Active Defense , we have not seen any similar work . Perhaps the most related one is ( Yang et al. , 2019 ) , which used sophisticated matrix completion techniques to reconstruct the random masked images . Our motivation is very different , as we try to exploit the deep network itself to enhance robustness without borrowing any third-party algorithms . 3 BACKGROUND . In the classification problem , given the training data set of image-label pairs D = { ( xi , yi ) } ni=1 where yi ∈ { 1 , 2 , ... , M } , the goal is to find an output probability vector F ( x ) of length M indexed by j , ideally such that y = argmaxjFj ( x ) . Of course , there is always a mismatch between these two terms . The key thing here is to find a suitable loss function such that the empirical risk minimization ( ERM ) of 1n n∑ i=1 L ( F ( xi ) , yi ) can be implemented with loss function L. Note that F ( xi ) is a vector , while yi is a scalar of the label , the very first thing is to transform yi into a vector through a vector function G ( yi ) . People usually adopt the one-hot coding H ( yi ) of length M with all elements being 0 except Hyi ( yi ) = 1 . The two probability distribution vectors F ( xi ) and H ( yi ) can be compared with cross-entropy . An adversary crafts an adversarial example xadv which is closest to x with ‖xadv − x‖p ≤ ε but misclassified as some other class . In this paper , we only consider attacks with p = ∞ . The most commonly used strategy is the iterative projected gradient descent method ( PGD ) xt+1adv = P ( x t adv + β × sign ( ∇xL ( xtadv , G ( y ) ) ) ) , ( 1 ) where β is the step size and P projects the generated example to the feasible region . Please note that L in adversarial attack may be different from L in training . People may choose traditional crossentropy loss with one-hot coding or CW loss ( Carlini & Wagner , 2017 ) to implement Equation 1 . Currently , a budget-aware step size-free variant of PGD has been proposed by ( Croce & Hein , 2020 ) , and since that , an ensemble of diverse parameter-free attacks called AutoAttack has become the de facto routine for robust accuracy evaluation . 4 METHOD . In general , our method is very simple . In training , for feature map F l of a particular layer l with W ×H × C , we use the loss L = Lce +max ( LF l , δ ) ( 2 ) LF l = 1 W ×H × C W∑ i=1 H∑ j=1 C∑ k=1 ∣∣F li , j , k −mean ( F l ) ∣∣ . ( 3 ) Here L has two terms . Lce is for cross-entropy loss , and LF l is our novel feature smoothing loss function . It is quite similar to the L1 norm of the particular feature cube and encourages the cube to be uniform . In order to avoid overfitting to the feature smoothing loss , we use max ( LF l , δ ) which disables the derivative of LF l when it drops below δ . In summary , we have two parameters , the feature layer l and the smoothing upper bound δ . Although this loss function sounds straightforward for our purpose to make the intermediate feature map smooth , there is a novel insight from the perspective of the trade-off between these two terms . In order to get low LF l , Lce will increase . In other words , after training , the network somehow understands that feature smoothing is not very annoying , and it only causes accuracy to drop to some extent . There is a huge implication in terms of robust accuracy . If we only use Lce , the network has no idea to deal with the crafted example except to be fooled . However , in our case , LF l gives us a dissipation channel of malicious perturbations that we can take via feature smoothing . Hopefully , this will remove most of the perturbations generated by an adversary , which we will elaborate on in our Active Defense design . The other concern may relate to the feature space constraints . Actually , due to the high capacity of networks , there is almost no difference in standard training accuracy between ours and cross-entropy loss . From the discussion above , our Active Defense is very intuitive . It consists of four steps depicted in the right of Figure 1 . In Step 1 , we add some random noise to an input which can somehow reduce the effect of adversarial disruptions ; more importantly , this will ensure sufficient iterations of feature smoothing . Otherwise , the attacker can bypass this and our Active Defense will fail . Steps 2 and 3 are just forward/backward passes related to LF l . In Step 4 , the noisy image get smoothed via gradient descent for LF l , and feeds into the network for another round of feature smoothing . The overall procedure of the proposed approach is in Algorithm 1 . There are only three parameters , i.e. , σ for uniform noise , β for the updating step size , and δ̃ for the upper bound of feature loss in test that is usually lower than δ for training in Equation 2 , as we pursue extra feature smoothing to deal with adversarial attacks . The updated example through Active Defense will feed into the network for final class decision . This algorithm can run a few times which we denoted as outerloop in the following sections . Algorithm 1 Active Defense Algorithm 1 : procedure ACTIVE DEFENSE ( t , LF l ) . t is a test example . 2 : t = t+ uniform ( −σ , σ ) . Step 1 , σ is the parameter of the uniform distribution . 3 : l = LF l ( t ) . Step 2 4 : while l > δ̃ do . δ̃ is the upper bound of feature loss in test . 5 : d = ∂l∂t . Step 3 6 : t = t− β × d . Step 4 , β is the step size . 7 : l = LF l ( t ) . Step 2 8 : end while 9 : return t 10 : end procedure

Summary: This paper aims to provide an approach to train a robust model, where the model is trained without adversarial examples. To this end, the authors introduce an inference-time defense strategy. However, this idea is not novel. Moreover, the inference-time defense strategy may give false robustness.