LEARNING ADVERSARIAL EXAMPLES WITH RIEMANNIAN GEOMETRY

1 INTRODUCTION . Recently Deep Neural Networks ( DNN ) achieve a big success on a wide range of challengeable tasks , such as image classification , speech recognition , and object detection ( LeCun et al. , 2015 ) ( He et al. , 2017 ) . However , recent studies have found that DNNs can be easily fooled by some special input called adversarial examples which are referred to as augmented data points generated by imperceptible perturbation of input samples ( Szegedy et al. , 2013 ) ( Biggio et al. , 2013 ) ( Nguyen et al. , 2015 ) . Although such perturbation is visually imperceptible , it can lead DNNs to make incorrect predictions with high confidence . There have been a lot of proposals studying how to generate more powerful adversarial examples , and how to build up robust networks to defend them ( Goodfellow et al. , 2014 ) ( Szegedy et al. , 2013 ) . This interesting problem was first studied in ( Liu & Nocedal , 1989 ) where the authors proposed a simple way to produce adversarial examples with L-BFGS optimization . A more powerful approach Fast Gradient Sign Method ( FGSM ) is later proposed in ( Goodfellow et al. , 2014 ) and further extended to a more general case with lp constraint for perturbation ( Lyu et al. , 2015 ) ( Shaham et al. , 2015 ) . The multi-step variant FGSMk was proposed in ( Kurakin et al. , 2016 ) which is essentially projected gradient decent ( PGD ) on the negative loss . Aside from studying how to generate adversarial examples , some researchers developed methods to defend them . The adversarial training was proposed by ( Goodfellow et al. , 2014 ) ( Lyu et al. , 2015 ) which augmented the training set with adversarial examples . This method not only increases the model robustness for adversarial examples but also improves the generalization for benign samples . Some feature squeezing ( Xu et al. , 2017 ) and defensive distillation ( Papernot et al. , 2016 ) were also exploited to resist adversarial attacking . Semisupervised version of adversarial training was developed in ( Miyato et al. , 2015 ) ( Miyato et al. , 2018 ) ( Miyato et al. , 2016 ) called Virtual Adversarial Training ( VAT ) , where the output distribution was smoothed by penalizing the KL-divergence between outputs of original and adversarial examples . Moreover , some researchers provided the theory and principles for adversarial examples ( Fawzi et al. , 2016 ) . Furthermore , ( Ma et al. , 2018 ) have demonstrated that the adversarial examples are a dense region of pixel space instead of isolated points . All these existing adversarial training methods simply consider the adversarial example problem in the Euclidean space with the orthogonal coordinate system . Specifically , this traditional adversarial training methods aim to solve a robust optimization problem ( Lyu et al. , 2015 ) : min θ E ( x , y ) vD [ max ϵ L ( x+ ϵ , y , θ ) ] s.t . ∥ϵ∥p ≤ σ ( 1 ) where L denotes a loss function and the pair of input and label ( x , y ) is assumed to be drawn from the data distribution D. The robust optimization problem is defined as a min-max problem with respect to the worst perturbation ϵ and the best model parameters θ . The adversarial perturbation ϵ is restricted within lp-ball around benign example x . The FGSM can be seen as a special case with p =∞ . Such restriction is defined in Euclidean space and the similarity between two points is measured by Minkowski distance . However , data points may be in practice attached on a geometric manifold which can not be appropriately described with Euclidean coordinate system . In this case , the Euclidean metric would be not rational . Moreover , existing adversarial training methods usually search the worst perturbation through the gradient of loss function with respect to x , since the gradient is considered as the steepest direction . However , in a geometric manifold , particularly in Riemannian space , the gradient of a loss function unnecessarily presents the steepest direction . Figure 1 illustrates the difference between a Riemannian space and the Euclidean space , where the detailed mathematic notation can be seen in Section 2 . Clearly , In this figure , assuming that the data are attached in the manifold as defined in Figure 1 ( a ) , the Euclidean distance may not appropriately reflect the true distance between two points ( e.g. , ξ ( 0 ) and ξ ( a ) ) . In this paper , we extend the traditional adversarial problem to Riemannian space and propose a novel adversarial method called Adversarial Training with Riemannian Manifold ( ATRM ) . ATRM is regarded as a generalized framework in that Riemannian space contains the Euclidean space as a special case . In more details , we start with defining the local coordinate system and Riemannian metric tensor to evaluate the similarity between two points in Riemannian space . We then propose to restrict the adversarial perturbation within lp-ball around natural examples x on Riemannian manifold , and develop a framework to search the worst perturbation through the generalized trust region method . Our proposed method is to solve the adversarial problem from the perspective of geometry which is similar to Natural Gradient methods ( Amari , 1998 ) , however , our method is implemented on input space instead of parameter space of DNNs . We list the main contributions of this paper as follows : 1 ) To our best knowledge , this is the first work to tackle the adversarial example problem through the perspective of geometry . 2 ) We study the adversarial example in the more generalized Riemannian space of which Euclidean space is a special case . 3 ) Our method considers the curvature information of the loss function which can be viewed as the second order method , enabling a more accurate direction of adversarial perturbation . Importantly , from the perspective of geometry , our method leads to the steepest direction of loss function in Riemannian space . 4 ) We also provide a series of theory showing that our proposed method can truly find the decent direction for the loss function with a comparable computational time against traditional adversarial method ( one more backward backward prorogation ) . 2 MAIN METHODOLOGY . In this section , we first study how to generate adversarial examples within l2-ball in Riemannian Manifold . We then define the local metric tensor on the manifold and generate the adversarial examples using our proposed ATRM with l2-ball restriction . Next , we extend our proposed method to lp-ball restriction on Riemannian manifold . Finally , we propose the adversarial training method called ATRM and also provide theories showing that ATRM can find the decent direction of the loss . 2.1 RIEMANNIAN GEOMETRY . In this subsection , we first introduce the mathematical notations and some background of geometry . The Einstein notation is used in this subsection . The Riemannian Manifold is defined as Definition 2.1 : Definition 2.1 . ( Riemannian Manifold ( Walschap , 2012 ) ) In differential geometry , a Riemannian manifold ( M , g ) is a real smooth manifold M equipped with inner product in tangent space TpM at each point p varying smoothly on M , defined by positive definite metric tensor gp . Theorem 2.1 . ( Geodesic ( Amari , 2016 ) ) A curve that connects two points by a minimal distance is a geodesic under the Levi-Civita connection , where the length of a curve c = ξ ( t ) connecting ξ ( 0 ) and ξ ( a ) is given by l = ∫ a 0 √ gij ( t ) ξ̇i ( t ) ξ̇j ( t ) dt ( 2 ) where gij ( t ) denotes the metric tensor at point ξ ( t ) . The geodesic can be calculated with Theorem 2.1 , which measures the distance of two points on Riemannian manifold . It can be seen as an extension of the Euclidian distance in Euclidian space . Lemma 2.2 . Let ξ ( 0 ) and ξ ( a ) be two close points on Riemannian manifold , where ξ ( t ) is a shortest curve connecting these two points . Then , the distance between these two points can be computed by : ds2 = gij ( t ) dθ idθj ( 3 ) where dθi = ξ̇ ( t ) idt is the ith component of small vector dθ and gij ( t ) is the metric tensor ( proof can be seen in Appendix D ) . We can also rewrite ds2 in form of inner production : ds2 = ⟨dθiei , dθjej⟩ = ⟨ei , ej⟩dθidθj ( 4 ) where basis vectors { ei } is the set of tangent vectors along the coordinate curves . Combining these two equations , we have : gij = ⟨ei , ej⟩ ( 5 ) Therefore , the metric tensor G = ( gij ) is the inner product of basis vectors . In the case of Euclidean space ( orthonormal coordinate system ) , the metric tensor is : gij = δij = { 1 i=j 0 otherwise ( 6 ) where δij represents the Kronecker delta . The Euclidean space can be viewed as a special case of Riemannian space with the identity metric tensor . For traditional adversarial training , the data are assumed to be in Euclidean space with the identity metric tensor . In this paper , we consider a more general case that the data are attached on the Riemannian manifold with positive definite metric tensor varying smoothly on the manifold . Figure 1 illustrates the difference between the two spaces . 2.2 ADVERSARIAL PERTURBATION WITHIN l2-BALL ON MANIFOLD In this subsection , we introduce in details how we exploit a generalized trust region method to search the adversarial perturbation on the Riemannian manifold . To search the adversarial examples on the Riemannian manifold feasibly , we propose to solve the inner optimization problem of ( 1 ) with the generalized trust region method : ϵ = argmax ϵ Tk { L , x , ϵ } s.t . d ( x , x+ ϵ ) ≤ σ ( 7 ) where ϵ is a small perturbation and σ is a small value . Tk { L , x , ϵ } denotes the kth order Taylor expansion of function L ( . ) around x evaluated at x + ϵ . Here k can be set to 1 or 2. d ( x , x + ϵ ) represents the distance between two points x and x + ϵ . In this paper , we follow the setting of previous research ( Lyu et al. , 2015 ) ( Shaham et al. , 2015 ) and provide the 1th Taylor expansion for the loss function L ( . ) . We define the d ( . ) geodesic distance between two points on Riemannian manifold . Since the perturbation ϵ is very small , by applying Lemma 2.2 , ( 7 ) can be reformulated as : ϵ = argmax ϵ L ( x ) +∇xLT ϵ s.t . gij ( x ) ϵiϵj ≤ σ2 ( 8 ) where G = ( gij ( x ) ) denotes the metric tensor at the point x on data manifold . In ( 7 ) , since geodesic d ( x , x + ϵ ) ≤ σ , the geodesic can be evaluated by ( 3 ) . It can be proved that we can solve the problem ( 8 ) with Lagrangian multiplier method and the worst perturbation can be given as : ϵ ∝ G−1∇xL ( 9 ) The detailed proof of ( 9 ) can be seen in Appendix A .

Summary: In the paper, the authors proposed to solve the learning problem of adversarial examples from Riemannian geometry viewpoint. More specifically, the Euclidean metric in Eq.(7) is generated to the Riemannian metric (Eq.(8)). Later, the authors built the correspondence between the metric tensor and the higher order of Taylor expansions.  Experiments show the improvement over the state-of-the art methods.