Min-Max Optimization without Gradients: Convergence and Applications to Adversarial ML

1 INTRODUCTION . In numerous real-world applications , one is faced with various forms of adversary that are not accounted for by standard optimization algorithms . For instance , when training a machine learning model on user-provided data , malicious users can carry out a data poisoning attack : providing false data with the aim of corrupting the learned model ( Steinhardt et al. , 2017 ; Tran et al. , 2018 ; Jagielski et al. , 2018 ) . At inference time , malicious users can evade detection of multiple models in the form of adversarial example attacks ( Goodfellow et al. , 2014 ; Liu et al. , 2016 ; 2018a ) . Min-max ( robust ) optimization is a natural framework to address adversarial ( worst-case ) robustness ( Madry et al. , 2017b ; Al-Dujaili et al. , 2018b ) . It converts a standard minimization problem into a composition of an inner maximization problem and an outer minimization problem . Min-max optimization problems have been studied for multiple decades ( Wald , 1945 ) , and the majority of the proposed methods assume access to first-order ( FO ) information , i.e . gradients , to find or approximate robust solutions ( Nesterov , 2007 ; Gidel et al. , 2017 ; Hamedani et al. , 2018 ; Qian et al. , 2019 ; Rafique et al. , 2018 ; Sanjabi et al. , 2018b ; Lu et al. , 2019 ; Nouiehed et al. , 2019 ; Lu et al. , 2019 ; Jin et al. , 2019 ) . In this paper , we focus on design and analysis of black-box ( gradient-free ) min-max optimization methods , where gradients are neither symbolically nor numerically available , or they are tedious to compute ( Conn et al. , 2009 ) . Our study is particularly motivated by the design of data poisoning and evasion adversarial attacks from black-box machine learning ( ML ) or deep learning ( DL ) systems , whose internal configuration and operating mechanism are unknown to adversaries . The extension of min-max optimization from the FO domain to the gradient-free regime is challenging since the solver suffers from uncertainties in both black-box objective functions and optimization procedure and do not scale well to high-dimensional problems . We develop a provable and unified black-box min-max stochastic optimization method by integrating a query-efficient randomized zeroth-order ( ZO ) gradient estimator with a computation-efficient alternating gradient descent-ascent framework , where the former requires a small number of function queries to build a gradient estimate , and the latter needs just one-step descent/ascent update . Recently , ZO optimization has attracted increasing attention in solving ML/DL problems . For example , ZO optimization serves as a powerful and practical tool for generation of black-box adversarial examples to evaluate the adversarial robustness of ML/DL models ( Chen et al. , 2017 ; Ilyas et al. , 2018 ; Tu et al. , 2018 ; Ilyas et al. , 2019 ) . ZO optimization can also help to solve automated ML problems , where the gradients with respect to ML pipeline configuration parameters are intractable ( Aggarwal et al. , 2019 ) . Furthermore , ZO optimization provides computationally-efficient alternatives of high-order optimization methods for solving complex ML/DL tasks , e.g. , robust training by leveraging input gradient or curvature regularization ( Finlay & Oberman , 2019 ; Moosavi-Dezfooli et al. , 2019 ) , modelagnostic meta-learning ( Fallah et al. , 2019 ) , network control and management ( Chen & Giannakis , 2018 ) , and data processing in high dimension ( Liu et al. , 2018b ) . Other recent applications include generating model-agnostic contrastive explanations ( Dhurandhar et al. , 2019 ) and escaping saddle points ( Flokas et al. , 2019 ) . Current studies ( Ghadimi & Lan , 2013 ; Nesterov & Spokoiny , 2015 ; Duchi et al. , 2015 ; Ghadimi et al. , 2016 ; Shamir , 2017 ; Liu et al. , 2019 ) suggested that ZO methods typically agree with the iteration complexity of FO methods but encounter a slowdown factor up to a small-degree polynomial of the problem dimensionality . To the best of our knowledge , it was an open question whether any convergence rate analysis can be established for black-box min-max optimization . Contribution . We summarize our contributions as follows . ( i ) We first identify a class of black-box attack and robust learning problems which turn out to be min-max black-box optimization problems . ( ii ) We propose a scalable and principled framework ( ZO-Min-Max ) for solving constrained minmax saddle point problems under both one-sided and two-sided black-box objective functions . Here the one-sided setting refers to the scenario where only the outer minimization problem is black-box . ( iii ) We provide a novel convergence analysis characterizing the number of objective function evaluations required to attain locally robust solution to black-box min-max problems with nonconvex outer minimization and strongly concave inner maximization . Our analysis handles stochasticity in both objective function and ZO gradient estimator , and shows that ZO-Min-Max yields O ( 1/T + 1/b + d/q ) convergence rate , where T is number of iterations , b is mini-batch size , q is number of random direction vectors used in ZO gradient estimation , and d is number of optimization variables . ( iv ) We demonstrate the effectiveness of our proposal in practical data poisoning and evasion attack generation problems.1 2 RELATED WORK . FO min-max optimization . Gradient-based methods have been applied with celebrated success to solve min-max problems such as robust learning ( Qian et al. , 2019 ) , generative adversarial networks ( GANs ) ( Sanjabi et al. , 2018a ) , adversarial training ( Al-Dujaili et al. , 2018b ; Madry et al. , 2017a ) , and robust adversarial attack generation ( Wang et al. , 2019b ) . Some of FO methods are motivated by theoretical justifications based on Danskin ’ s theorem ( Danskin , 1966 ) , which implies that the negative of the gradient of the outer minimization problem at inner maximizer is a descent direction ( Madry et al. , 2017a ) . Convergence analysis of other FO min-max methods has been studied under different problem settings , e.g. , ( Lu et al. , 2019 ; Qian et al. , 2019 ; Rafique et al. , 2018 ; Sanjabi et al. , 2018b ; Nouiehed et al. , 2019 ) . It was shown in ( Lu et al. , 2019 ) that a deterministic FO min-max algorithm has O ( 1/T ) convergence rate . In ( Qian et al. , 2019 ; Rafique et al. , 2018 ) , stochastic FO min-max methods have also been proposed , which yield the convergence rate in the order of O ( 1/ √ T ) and O ( 1/T 1/4 ) , respectively . However , these works were restricted to unconstrained optimization at the minimization side . In ( Sanjabi et al. , 2018b ) , noncovnex-concave min-max problems were studied , but the proposed analysis requires solving the maximization problem only up to some small error . In ( Nouiehed et al. , 2019 ) , the O ( 1/T ) convergence rate was proved for nonconvex-nonconcave min-max problems under Polyak- Łojasiewicz conditions . Different from the aforementioned FO settings , ZO min-max stochastic optimization suffers randomness from both stochastic sampling in objective function and ZO gradient estimation , and this randomness would be coupled in alternating gradient descent-descent steps and thus make it more challenging in convergence analysis . Gradient-free min-max optimization . In the black-box setup , coevolutionary algorithms were used extensively to solve min-max problems ( Herrmann , 1999 ; Schmiedlechner et al. , 2018 ) . However , they may oscillate and never converge to a solution due to pathological behaviors such as focusing and relativism ( Watson & Pollack , 2001 ) . Fixes to these issues have been proposed and analyzed—e.g. , 1Source code will be released . asymmetric fitness ( Jensen , 2003 ; Branke & Rosenbusch , 2008 ) . In ( Al-Dujaili et al. , 2018c ) , the authors employed an evolution strategy as an unbiased approximate for the descent direction of the outer minimization problem and showed empirical gains over coevlutionary techniques , albeit without any theoretical guarantees . Min-max black-box problems can also be addressed by resorting to direct search and model-based descent and trust region methods ( Audet & Hare , 2017 ; Larson et al. , 2019 ; Rios & Sahinidis , 2013 ) . However , these methods lack convergence rate analysis and are difficult to scale to high-dimensional problems . For example , the off-the-shelf model-based solver COBYLA only supports problems with 216 variables at maximum in SciPy Python library ( Jones et al. , 2001 ) , which is even smaller than the size of a single ImageNet image . The recent work ( Bogunovic et al. , 2018 ) proposed a robust Bayesian optimization ( BO ) algorithm and established a theoretical lower bound on the required number of the min-max objective evaluations to find a near-optimal point . However , BO approaches are often tailored to low-dimensional problems and its computational complexity prohibits scalable application . From a game theory perspective , the min-max solution for some problems correspond to the Nash equilibrium between the outer minimizer and the inner maximizer , and hence black-box Nash equilibria solvers can be used ( Picheny et al. , 2019 ; Al-Dujaili et al. , 2018a ) . This setup , however , does not always hold in general . Our work contrasts with the above lines of work in designing and analyzing black-box min-max techniques that are both scalable and theoretically grounded . 3 PROBLEM SETUP . In this section , we define the black-box min-max problem and briefly motivate its applications . By min-max , we mean that the problem is a composition of inner maximization and outer minimization of the objective function f . By black-box , we mean that the objective function f is only accessible via point-wise functional evaluations . Mathematically , we have min x∈X max y∈Y f ( x , y ) ( 1 ) where x and y are optimization variables , f is a differentiable objective function , and X ⊂ Rdx and Y ⊂ Rdy are compact convex sets . For ease of notation , let dx = dy = d. In ( 1 ) , the objective function f could represent either a deterministic loss or stochastic loss f ( x , y ) = Eξ∼p [ f ( x , y ; ξ ) ] , where ξ is a random variable following the distribution p. In this paper , we consider the stochastic variant in ( 1 ) . We focus on two black-box scenarios in which gradients ( or stochastic gradients under randomly sampled ξ ) of f w.r.t . x or y are not accessed . ( a ) One-sided black-box : f ( x , y ) is a white box w.r.t . y but a black box w.r.t . x . ( b ) Two-sided black-box : f ( x , y ) is a black box w.r.t . both x and y . Motivation of setup ( a ) and ( b ) . Both setups are well motivated from the design of black-box adversarial attacks . The formulation of the one-sided black-box min-max problem corresponds to a particular type of attack , known as black-box ensemble evasion attack , where the attacker generates adversarial examples ( i.e. , crafted examples with slight perturbations for misclassification at the testing phase ) and optimizes its worst-case performance against an ensemble of black-box classifiers and/or example classes . The formulation of two-sided black-box min-max problem represents another type of attack at the training phase , known as black-box poisoning attack , where the attacker deliberately influences the training data ( by injecting poisoned samples ) to manipulate the results of a black-box predictive model . Although problems of designing ensemble evasion attack ( Liu et al. , 2016 ; 2018a ; Wang et al. , 2019b ) and data poisoning attack ( Jagielski et al. , 2018 ; Wang et al. , 2019a ) have been studied in the literature , most of them assumed that the adversary has the full knowledge of the target ML model , leading to an impractical white-box attack setting . By contrast , we provide a solution to min-max attack generation under black-box ML models . We refer readers to Section 6 for further discussion and demonstration of our framework on these problems .

Summary: The paper presents an algorithm for performing min-max optimisation without gradients and analyses its convergence. The algorithm is evaluated for the min-max problems that arise in the context of adversarial attacks. The presented algorithm is a natural application of a zeroth-order gradient estimator and the authors also prove that the algorithm has a sublinear convergence rate (in a specific sense).