Self-ensemble Adversarial Training for Improved Robustness

1 INTRODUCTION . Deep learning techniques have showed promise in disciplines such as computer vision ( Krizhevsky et al. , 2012 ; He et al. , 2016 ) , natural language processing ( Vaswani et al. , 2017 ; Devlin et al. , 2019 ) , speech recognition ( DBL , 2012 ; Sak et al. , 2015 ) and even in protein structural modeling ( Si & Yan , 2021 ; Jumper et al. , 2021 ) . However , even for those efforts surpassing human-level performance in several fields ( Jia et al. , 2021 ; Gleave et al. , 2020 ; Xu et al. , 2019 ; 2018b ; Wang et al. , 2020a ) , deep learning based methods are vulnerable to adversarial examples generated by adding small adversarial perturbations to natural examples ( Szegedy et al. , 2014 ; Goodfellow et al. , 2015 ) . Following the discovery of this adversarial vulnerability , numerous defense approaches for protecting DNNs from adversarial attacks have been proposed ( Xu et al. , 2018a ; Liao et al. , 2018 ; Qin et al. , 2020 ; Papernot et al. , 2016 ; Ross & Doshi-Velez , 2018 ) . Because it is a straightforward and effective data-driven strategy , among these methods , adversarial training has become the de-facto way for strengthening the robustness of neural networks . The core of adversarial training is proactively inducing a robust model by forcing DNNs to learn adversarial examples generated from the current model , which helps DNNs gradually make up for their deficiencies . Therefore , it is a practical learning framework to alleviate the impact of adversarial attacks . As a saying goes , a person may go faster but a team can go farther . An ensemble of classifiers fused by output aggregates the collective wisdom of all participated classifiers , which outperform the decision made by a single classifier . Many ensemble methods ( Tramèr et al. , 2018 ; Pang et al. , 2019 ; Kurakin et al. , 2018 ) have shown their abilities to boost adversarial robustness . Despite averaged predictions of different models enables the aggregation against a large number of attacks , it is still a heavy computing burden to adversarially train all the member models . What is worse , the architectures and parameters of every member model , as well as their related contribution factors , should be safely saved and need performing forward propagation for every member repeatedly , which is a nightmare when dealing with massive components . Despite the fact that the ensemble technique adopts a variety of architectures and parameters , these models may have similar decision-making boundaries ( Tramèr et al. , 2017 ) . Therefore , it is natural to wonder : Could we develop the potential of the classifier itself to build a robust model rather than rely on multiple seemingly disparate classifiers ? Could we make use of states on the searching trajectory of optimization when performing adversarial training ? Motivated by these questions , we discuss the relationship between an ensemble of different classifiers fused by predictions and by parameters , and present a computation-friendly self-ensemble method named SEAT . In summary , this paper has the following contributions : • By rethinking the standard adversarial training and its variants , instead of developing a well-designed loss to find a single optimal in the weight space , we design an efficient algorithm called Self-Ensemble Adversarial Training ( SEAT ) by uniting states of every history model on the optimization trajectory through the process of adversarial training . Unlike the traditional ensemble technique , which is extremely time-consuming and repeating adversarial training procedures for individuals , SEAT simply requires training once . • We present a theoretical explanation of the differences between the two ensemble approaches discussed above and visualize the change of loss landscape caused by SEAT . Furthermore , while using data augmentation of external data can experimentally fix the deterioration during the late stages ( Gowal et al. , 2020 ; Rebuffi et al. , 2021 ) , we further investigate a subtle but fatal intrinsic issue in the general settings for the self-ensemble model , which causes the deterioration of the weight-ensembled method . • We thoroughly compare adversarial robustness of SEAT with other models trained by the state-of-the-art techniques against several attack methods on CIFAR-10 and CIFAR-100 datasets . Results have shown that the SEAT method itself can efficiently search in the weight space and significantly improve adversarial robustness . 2 REVIEW : STANDARD ADVERSARIAL TRAINING AND ITS SUCCESSORS . In this section , we first introduce basic concepts of adversarial training . Then we briefly review some variants and enhancements of standard adversarial training . 2.1 PRELIMINARIES . Consider a standard image task which involves classifying an input image into one of K classes , let x ∈ [ 0 , 1 ] n denote the input natural image and y ∈ { 1 , 2 , . . . , K } be the ground truth label , sampled from a distribution D. For adversarial attack , the goal of the adversary is to seek a malignant example in the vicinity of x , by adding a human imperceptible perturbation ε ∈ Rn . To exactly describe the meaning of “ imperceptible ” , this neighbor region Bε ( x ) anchored at x with apothem ε can be defined as Bε ( x ) = { ( x′ , y ) ∈ D | ‖x− x′‖ ≤ ε } . We also define a loss function : ` def = Θ × D → [ 0 , ∞ ) , which is usually positive , bounded , and upper-semi continuous ( Blanchet & Murthy , 2019 ; Villani , 2003 ; Bartlett & Mendelson , 2001 ) for all θ ∈ Θ . Instead of the original formulation of adversarial training ( Szegedy et al. , 2014 ; Goodfellow et al. , 2015 ) , which mixes natural examples x and adversarial examples x′ together to train models , the adversarial risk minimization problem can be formulated as a two-player game that writes as below : inf θ∈Θ E ( x , y ) ∼D︸ ︷︷ ︸ Outer minimization sup x′∈Bε ( x ) ` ( θ ; x′ , y ) ︸ ︷︷ ︸ Inner maximization . ( 1 ) In general , the adversary player iteratively computes more and more harmful perturbations step by step , where the PGD method ( Madry et al. , 2018 ) is commonly applied : xt+1 = ΠB ( x , ) ( xt + κ sign ( ∇x ` ( x , y ) ) ) , ( 2 ) where κ is the step size and the generated samples at each iteration will be projected back to the Bε ( x ) . When finding x′ at their current optimal in the inner maximization , the model parameters will be updated according to these fixed samples only in the outer minimization . 2.2 RELATED WORK . Emerging adversarial training methods are primarily concerned with strengthening their robustness through empirical defense . Here we roughly separate these improvements into two categories : ( 1 ) sample-oriented ( i.e . for x′ in the inner maximization ) and ( 2 ) loss-oriented ( i.e . for ` in the outer minimization ) improvement . From the side of the former , Baluja & Fischer ( 2017 ) utilize a GAN framework to create adversarial examples via the generative model while FAT ( Zhang et al. , 2020 ) proposes a PGD-based method which control the length of searching trajectories of PGD through the lens of geometry . For the latter , a stream of works have been carried out with the goal of establishing a new supervised loss for better optimization . Usually , the loss ` in the both inner maximization and outer minimization1 are cross-entropy ( Good , 1956 ) defined as : ` ce = −yT log q when given the probability vector q = [ efθ ( x ′ ) 1 , · · · , efθ ( x′ ) c ] / ∑c k=1 e fθ ( x ′ ) k . The addition of a regularizer to the vanilla loss is one branch of the modification . Representative works like ALP ( Kannan et al. , 2018 ) , TRADES ( Zhang et al. , 2019 ) , and VAT ( Miyato et al. , 2019 ) introduce a regularization term to smooth the gap between the probability output of natural examples and adversarial ones , which can be denoted as : ` reg = ` ce + η ∑ ( xi , yi ) ∼B R ( p ( θ ; x′i , yi ) , p ( θ ; xi , yi ) ) , ( 3 ) where η is the regularization hyper-parameter and R ( · , · ) is l2 distance for ALP and VAT2 , and Kullback-Leibler divergence for TRADES . B stands for the sampled minibatch . Another branch of the loss modification is to reweight the contributions of each instance in the minibatch based on their intrinsic characteristics . This can be formulated by : ` rew = ∑ ( xi , yi ) ∼B w ( θ ; xi , x ′ i , yi ) ` ce ( θ ; xi , x ′ i , yi ) , ( 4 ) where w ( · ) is a real-valued function mapping the input instances to an importance score . MMA ( Ding et al. , 2020 ) separately considers the correct and incorrect classification on natural cases and switches between them by learning a hard importance weight : ` MMA = ∑ ( xi , yi ) ∼B w1 ( θ ; xi , yi ) ` ce ( θ ; xi , yi ) + w2 ( θ ; xi , yi ) ` ce ( θ ; x ′ i , yi ) , ( 5 ) where w1 and w2 are the indicator function 1 ( fθ ( xi ) 6= yi ) and 1 ( fθ ( xi ) = yi ) , respectively . Inspired by the geometry concern of FAT , GAIRAT ( Zhang et al. , 2021 ) evaluates w ( θ ; x , y ) = ( 1 + tanh ( c1 − 10c2 + 5 ) ) /2 to adaptively control the contribution of different instances by their corresponding geometric distance of PGD , where c1 is a hyper-parameter and c2 is the ratio of the minimum successful iteration numbers of PGD to the maximum iteration step . Embracing both two schools of improvement , MART ( Wang et al. , 2020b ) adds a new regularization term apart from KL divergence and explicitly assigns weights within regularizers : ` MART = ` ce + ∑ ( xi , yi ) ∼B w ( θ ; xi , yi ) RKL ( p ( θ ; x′i , yi ) , p ( θ ; xi , yi ) ) +Rmag ( p ( θ ; x′i , yi ) ) , ( 6 ) whereRKL is Kullback-Leibler divergence same as TRADES and wi = ( 1− p ( θ ; xi , yi ) ) is a softer scheme when compared with MMA . The margin termRmag = − log ( 1−maxk 6=yi pk ( θ ; x′i , yi ) ) aims at improving the decision boundary . The above methods endeavor to solve the highly non-convex and non-concave optimization in Eqn 1 . However , they assume that the optimal weights of a classifier appear in its prime and abandon all the states along the route of optimization , which are beneficial to approach the optimal .

Summary: The authors of the paper propose a new method for improving the robustness of a model against adversarial attacks. If I understood correctly, the proposed method is a combination of both adversarial training and model ensembling, where in this instance the ensembling is performed by maintaining a moving average of the weights of the model at past time steps.   In addition to some providing some theorems concerning their proposed method, the authors empirically show that the trained SEAT models are competitive with current methods for improving the adversarial robustness of the method.