A Direct Approach to Robust Deep Learning Using Adversarial Networks

1 INTRODUCTION . Deep neural networks have been successfully applied to a variety of tasks , including image classification ( Krizhevsky et al. , 2012 ) , speech recognition ( Graves et al. , 2013 ) , and human-level playing of video games through deep reinforcement learning ( Mnih et al. , 2015 ) . However , Szegedy et al . ( 2014 ) showed that convolutional neural networks ( CNN ) are extremely sensitive to carefully crafted small perturbations added to the input images . Since then , many adversarial examples generating methods have been proposed , including Jacobian based saliency map attack ( JSMA ) ( Papernot et al. , 2016a ) , projected gradient descent ( PGD ) attack ( Madry et al. , 2018 ) , and C & W ’ s attack ( Carlini & Wagner , 2017 ) . In general , there are two types of attack models : white box attack and black box attack . Attackers in white box attack model have complete knowledge of the target network , including network ’ s architecture and parameters . Whereas in black box attacks , attackers only have partial or no information on the target network ( Papernot et al. , 2017 ) . Various defensive methods have been proposed to mitigate the effect of the adversarial examples . Adversarial training which augments the training set with adversarial examples shows good defensive performance in terms of white box attacks ( Kurakin et al. , 2017 ; Madry et al. , 2018 ) . Apart from adversarial training , there are many other defensive approaches including defensive distillation ( Papernot et al. , 2016b ) , using randomization at inference time ( Xie et al. , 2018 ) , and thermometer encoding ( Buckman et al. , 2018 ) , etc . In this paper , we propose a defensive method based on generative adversarial network ( GAN ) ( Goodfellow et al. , 2014 ) . Instead of using the generative network to generate samples that can fool the discriminative network as real data , we train the generative network to generate ( additive ) adversarial noise that can fool the discriminative network into misclassifying the input image . This allows flexible modeling of the adversarial noise by the generative network , which can take in the original image or a random vector or even the class label to create different types of noise . The discriminative networks used in our approach are just the usual neural networks designed for their specific classification tasks . The purpose of the discriminative network is to classify both clean and adversarial example with correct label , while the generative network aims to generate powerful perturbations to fool the discriminative network . This approach is simple and it directly uses the minimax game concept employed by GAN . Our main contributions include : • We show that our adversarial network approach can produce neural networks that are robust towards black box attacks . In the experiments they show similar , and in some cases better , performance when compared to state-of-art defense methods such as ensemble adversarial training ( Tramèr et al. , 2018 ) and adversarial training with projected gradient descent ( Madry et al. , 2018 ) . To our best knowledge we are also the first to study the joint training of a generative attack network and a discriminative network . • We study the effectiveness of different generative networks in attacking a trained discriminative network , and show that a variety of generative networks , including those taking in random noise or labels as inputs , can be effective in attacks . We also show that training against these generative networks can provide robustness against different attacks . The rest of the paper is organized as follows . In Section 2 , related works including multiple attack and defense methods are discussed . Section 3 presents our defensive method in details . Experimental results are shown in Section 4 , with conclusions of the paper in Section 5 . 2 RELATED WORKS . In this section , we briefly review the attack and defense methods in neural network training . 2.1 ATTACK MODEL . Given a neural network model Dθ parameterized by θ trained for classification , an input image x ∈ Rd and its label y , we want to find a small adversarial perturbation ∆x such that x+ ∆x is not classified as y . The minimum norm solution ∆x can be described as : arg min ∆x ‖∆x‖ s.t . arg maxDθ ( x+ ∆x ) 6= y , ( 1 ) where arg maxDθ ( x ) gives the predicted class for input x. Szegedy et al . ( 2014 ) introduced the first method to generate adversarial examples by considering the following optimization problem , ∆x = arg min z λ‖z‖+ L ( Dθ ( x+ z ) , ŷ ) , x+ z ∈ [ 0 , 1 ] d ( 2 ) where L is a distance function measuring the closeness of the outputDθ ( x+z ) with some target ŷ 6= y . The objective is minimized using box-constrained L-BFGS . Goodfellow et al . ( 2015 ) introduced the fast gradient sign method ( FGS ) to generate adversarial examples in one step , which can be represented as ∆x = · sign ( ∇xl ( Dθ ( x ) , y ) ) , where l is the cross-entropy loss used in neural networks training . Madry et al . ( 2018 ) argues with strong evidence that projected gradient descent ( PGD ) , which can be viewed as an iterative version of the fast gradient sign method , is the strongest attack using only first-order gradient information . Papernot et al . ( 2017 ) presented a Jacobian-based saliency-map attack ( J-BSMA ) model to generate adversarial examples by changing a small number of pixels . Moosavi-Dezfooli et al . ( 2017 ) showed that there exist a single/universal small image perturbation that fools all natural images . Papernot et al . ( 2017 ) introduced the first demonstration of black-box attacks against neural network classifiers . The adversary has no information about the architecture and parameters of the neural networks , and does not have access to large training dataset . 2.2 DEFENSE MODEL . In order to mitigate the effect of the generated adversarial examples , various defensive methods have been proposed . Papernot et al . ( 2016b ) introduced distillation as a defense to adversarial examples . Lou et al . ( 2016 ) introduced a foveation-based mechanism to alleviate adversarial examples . The idea of adversarial training was first proposed by Szegedy et al . ( 2014 ) . The effect of adversarial examples can be reduced through explicitly training the model with both original and perturbed adversarial images . Adversarial training can be viewed as a minimax game , θ∗ = arg min θ Ex , y max ∆x l ( Dθ ( x+ ∆x ) , y ) . ( 3 ) The inner maximization requires a separate oracle for generating the perturbations ∆x . FGS is a common method for generating the adversarial perturbations ∆x due to its speed . Madry et al . ( 2018 ) advocates the use of PGD in generating adversarial examples . Moreover , a cascade adversarial training is presented in Na et al . ( 2018 ) , which injects adversarial examples from an already defended network added with adversarial images from the network being trained . There are a few recent works on using GANs for generating and defending against adversarial examples . Samangouei et al . ( 2018 ) and Ilyas et al . ( 2017 ) use GAN for defense by learning the manifold of input distribution with GAN , and then project any input examples onto this learned manifold before classification to filter out any potential adversarial noise . Our approach is more direct because we do not learn the input distribution and no input denoising is involved . Both Baluja & Fischer ( 2018 ) and Xiao et al . ( 2018 ) train neural networks to generate adversarial examples by maximizing the loss over a fixed pre-trained discriminative network . They show that they can train neural networks to effectively attack undefended discriminative networks while ensuring the generated adversarial examples look similar to the original samples . Our work is different from these because instead of having a fixed discriminative network , we co-train the discriminative network together with the adversarial generative network in a minimax game . Xiao et al . ( 2018 ) also train a second discriminative network as in typical GANs , but their discriminative network is used for ensuring the generated images look like the original samples , and not for classification . Lee et al . ( 2017 ) also considered the use of GAN to train robust discriminative networks . However , the inputs to their generative network is the gradient of the discriminative network with respect to the input image x , not just the image x as in our current work . This causes complex dependence of the gradient of the generative network parameters to the discriminative network parameters , and makes the parameter updates for the generative network more complicated . Also there is no single minimax objective that they are solving for in their work ; the update rules for the discriminative and generative networks optimize related but different objectives . 3 METHOD . In generative adversarial networks ( GAN ) ( Goodfellow et al. , 2014 ) , the goal is to learn a generative neural network that can model a distribution of unlabeled training examples . The generative network transforms a random input vector into an output that is similar to the training examples , and there is a separate discriminative network that tries to distinguish the real training examples against samples generated by the generative network . The generative and discriminative networks are trained jointly with gradient descent , and at equilibrium we want the samples from the generative network to be indistinguishable from the real training data by the discriminative network , i.e. , the discriminative network does no better than doing a random coin flip . We adopt the GAN approach in generating adversarial noise for a discriminative model to train against . This approach has already been hinted at in Tramèr et al . ( 2018 ) , but they decided to train against a static set of adversarial models instead of training against a generative noise network that can dynamically adapt in a truly GAN fashion . In this work we show that this idea can be carried out fruitfully to train robust discriminative neural networks . Given an input x with correct label y , from the viewpoint of the adversary we want to find additive noise ∆x such that x + ∆x will be incorrectly classified by the discriminative neural network to some other labels ŷ 6= y . We model this additive noise as G ( x ) , where G is a generative neural network that generates instance specific noise based on the input x and is the scaling factor that controls the size of the noise . Notice that unlike white box attack methods such as FGS or PGD , once trained G does not need to know the parameters of the discriminative network that it is attacking . G can also take in other inputs to generate adversarial noise , e.g. , Gaussian random vector z ∈ Rd as in typical GAN , or even the class label y . For simplicity we assume G takes in x as input in the descriptions below . Suppose we have a training set { ( x1 , y1 ) , . . . , ( xn , yn ) } of image-label pairs . Let Dθ be the discriminator network ( for classification ) parameterized by θ , and Gφ be the generator network parameterized by φ . We want to solve the following minimax game between Dθ and Gφ : min θ max φ n∑ i=1 l ( Dθ ( xi ) , yi ) + λ n∑ i=1 l ( Dθ ( xi + Gφ ( xi ) ) , yi ) , ( 4 ) where l is the cross-entropy loss , λ is the trade-off parameter between minimizing the loss on normal examples versus minimizing the loss on the adversarial examples , and is the magnitude of the noise . See Figure 1 for an illustration of the model . In this work we focus on perturbations based on ` ∞ norm . This can be achieved easily by adding a tanh layer as the final layer of the generator network Gφ , which normalizes the output to the range of [ −1 , 1 ] . Perturbations based on ` 1 or ` 2 norms can be accommodated by having the appropriate normalization layers in the final layer of Gφ . We now explain the intuition of our approach . Ideally , we would like to find a solution θ that has small risk on clean examples R ( θ ) = n∑ i=1 l ( Dθ ( xi ) , yi ) , ( 5 ) and also small risk on the adversarial examples under maximum perturbation of size Radv ( θ ) = n∑ i=1 max ∆x , ‖∆x‖≤ l ( Dθ ( xi + ∆x ) , yi ) . ( 6 ) However , except for simple datasets like MNIST , there are usually fairly large differences between the solutions ofR ( θ ) and solutions ofRadv ( θ ) under the same model classDθ ( Tsipras et al. , 2018 ) . Optimizing for the risk under white box attacks Radv ( θ ) involves tradeoff on the risk on clean data R ( θ ) . Note that Radv ( θ ) represent the risk under white box attacks , since we are free to choose the perturbation ∆x with knowledge of θ . This can be approximated using the powerful PGD attack . Instead of allowing the perturbations ∆x to be completely free , we model the adversary as a neural network Gφ with finite capacity RG ( θ ) = max φ n∑ i=1 l ( Dθ ( xi + Gφ ( xi ) ) , yi ) . ( 7 ) Here the adversarial noise Gφ ( xi ) is not allowed to directly depend on the discriminative network parameters θ . Also , the generative network parameter φ is shared across all examples , not computed per example like ∆x . We believe this is closer to the situation of defending against black box attacks , when the adversary does not know the discriminator network parameters . However , we still want Gφ to be expressive enough to represent powerful attacks , so that Dθ has a good adversary to train against . Previous work ( Xiao et al. , 2018 ; Baluja & Fischer , 2018 ) show that there are powerful classes of Gφ that can attack trained classifiers Dθ effectively . In traditional GANs we are most interested in the distributions learned by the generative network . The discriminative network is a helper that drives the training , but can be discarded afterwards . In our setting we are interested in both the discriminative network and the generative network . The generative network in our formulation can give us a powerful adversary for attacking , while the discriminative network can give us a robust classifier that can defend against adversarial noise .

Summary: The paper "A Direct Approach to Robust Deep Learning Using Adversarial Networks" proposes a GAN solution for deep models of classification, faced to white and black box attacks. It defines an architecture where a generator network seeks to produce slight pertubations that succeed in fooling the discriminator. The discriminator is the targetted classification model.