Generalizable Adversarial Training via Spectral Normalization

1 INTRODUCTION . Despite their impressive performance on many supervised learning tasks , deep neural networks ( DNNs ) are often highly susceptible to adversarial perturbations imperceptible to the human eye ( Szegedy et al. , 2013 ; Goodfellow et al. , 2014b ) . These “ adversarial attacks '' have received enormous attention in the machine learning literature over recent years ( Goodfellow et al. , 2014b ; Moosavi Dezfooli et al. , 2016 ; Carlini & Wagner , 2016 ; Kurakin et al. , 2016 ; Papernot et al. , 2016 ; Carlini & Wagner , 2017 ; Papernot et al. , 2017 ; Madry et al. , 2018 ; Tramèr et al. , 2018 ) . Adversarial attack studies have mainly focused on developing effective attack and defense schemes . While attack schemes attempt to mislead a trained classifier via additive perturbations to the input , defense mechanisms aim to train classifiers robust to these perturbations . Although existing defense methods result in considerably better performance compared to standard training methods , the improved performance can still be far below the performance in non-adversarial settings ( Athalye et al. , 2018 ; Schmidt et al. , 2018 ) . A standard adversarial training scheme involves fitting a classifier using adversarially-perturbed samples ( Szegedy et al. , 2013 ; Goodfellow et al. , 2014b ) with the intention of producing a trained classifier with better robustness to attacks on future ( i.e . test ) samples . Madry et al . ( 2018 ) provides a robust optimization interpretation of the adversarial training approach , demonstrating that this strategy finds the optimal classifier minimizing the average worst-case loss over an adversarial ball centered at each training sample . This minimax interpretation can also be extended to distributionally-robust training methods ( Sinha et al. , 2018 ) where the offered robustness is over a Wasserstein-ball around the empirical distribution of training data . Recently , Schmidt et al . ( 2018 ) have shown that standard adversarial training produces networks that generalize poorly . The performance of adversarially-trained DNNs over test samples can be significantly worse than their training performance , and this gap can be far greater than the generalization ∗Equal Contributors gap achieved using standard empirical risk minimization ( ERM ) . This discrepancy suggests that the overall adversarial test performance can be improved by applying effective regularization schemes during adversarial training . In this work , we propose using spectral normalization ( SN ) ( Miyato et al. , 2018 ) as a computationallyefficient and statistically-powerful regularization scheme for adversarial training of DNNs . SN has been successfully implemented and applied for DNNs in the context of generative adversarial networks ( GANs ) ( Goodfellow et al. , 2014a ) , resulting in state-of-the-art deep generative models for several benchmark tasks ( Miyato et al. , 2018 ) . Moreover , SN ( Tsuzuku et al. , 2018 ) and other similar Lipschitz regularization techniques ( Cisse et al. , 2017 ) have been successfully applied in non-adversarial training settings to improve the robustness of ERM-trained networks to adversarial attacks . The theoretical results in ( Bartlett et al. , 2017 ; Neyshabur et al. , 2017a ) and empirical results in ( Yoshida & Miyato , 2017 ) also suggest that SN can close the generalization gap for DNNs in non-adversarial ERM setting . On the theoretical front , we extend the standard notion of margin loss to adversarial settings . We leverage the PAC-Bayes generalization framework ( McAllester , 1999 ) to prove generalization bounds for spectrally-normalized DNNs in terms of our defined adversarial margin loss . We obtain adversarial generalization error bounds for three well-known gradient-based attack schemes : fast gradient method ( FGM ) ( Goodfellow et al. , 2014b ) , projected gradient method ( PGM ) ( Kurakin et al. , 2016 ) , and Wasserstein risk minimization ( WRM ) ( Sinha et al. , 2018 ) . Our theoretical analysis shows that the adversarial generalization error will vanish by applying SN to all layers . On the empirical front , we show that SN can significantly improve the test performance of adversarially-trained DNNs . We perform numerical experiments over various standard datasets and DNN architectures . In almost all of our experiments , we obtain a better test performance after applying SN . For example , Figure 1 shows the training and validation performance for AlexNet fit on the CIFAR10 dataset using FGM , PGM , and WRM , resulting in adversarial test accuracy improvements of 9 , 11 , and 4 percent , respectively . To perform our numerical experiments , we develop a computationally-efficient approach for normalizing the spectral norm of convolution layers with arbitrary stride and padding schemes . To summarize , the main contributions of this work are : 1 . Proposing SN as a regularization scheme for adversarial training of DNNs , 2 . Extending concepts of margin-based generalization analysis to adversarial settings and proving margin-based generalization bounds for three gradient-based adversarial attack schemes , 3 . Developing an efficient method for normalizing the spectral norm of convolutional layers in deep convolution networks , 4 . Numerically demonstrating the improved test and generalization performance of DNNs trained with SN . 2 PRELIMINARIES . In this section , we first review some standard concepts of margin-based generalization analysis in learning theory . We then extend these notions to adversarial training settings . 2.1 SUPERVISED LEARNING , DEEP NEURAL NETWORKS , GENERALIZATION ERROR . Consider samples { ( x1 , y1 ) , . . . , ( xn , yn ) } drawn i.i.d from underlying distribution PX , Y . We suppose X ∈ X and Y ∈ { 1 , 2 , . . . , m } where m represents the number of different labels . Given loss function ` and function class F = { fw , w ∈ W } parameterized by w , a supervised learner aims to find the optimal function in F minimizing the expected loss ( risk ) averaged over the underlying distribution P . We consider Fnn as the class of d-layer neural networks with h hidden units per layer and activation functions σ : R→ R. Each fw : X → Rm in Fnn maps a data point x to an m-dimensional vector . Specifically , we can express each fw ∈ Fnn as fw ( x ) = Wdσ ( Wd−1 · · ·σ ( W1x ) · · · ) ) . We use ‖Wi‖2 to denote the spectral norm of matrix Wi , defined as the largest singular value of Wi , and ‖Wi‖F to denote Wi ’ s Frobenius norm . A classifier fw ’ s performance over the true distribution of data can be different from the training performance over the empirical distribution of training samples P̂ . The difference between the empirical and true averaged losses , evaluated on respectively training and test samples , is called the generalization error . Similar to Neyshabur et al . ( 2017a ) , we evaluate a DNN ’ s generalization performance using its expected margin loss defined for margin parameter γ > 0 as Lγ ( fw ) : = P ( fw ( X ) [ Y ] ≤ γ + max j 6=Y fw ( X ) [ j ] ) , ( 1 ) where fw ( X ) [ j ] denotes the jth entry of fw ( X ) ∈ Rm . For a given data point X , we predict the label corresponding to the maximum entry of fw ( X ) . Also , we use L̂γ ( fw ) to denote the empirical margin loss averaged over the training samples . The goal of margin-based generalization analysis is to provide theoretical comparison between the true and empirical margin risks . 2.2 ADVERSARIAL ATTACKS , ADVERSARIAL TRAINING . A supervised learner observes only the training samples and hence does not know the true distribution of data . Then , a standard approach to train a classifier is to minimize the empirical expected loss ` over function class F = { fw : w ∈ W } , which is min w∈W 1 n n∑ i=1 ` ( fw ( xi ) , yi ) . ( 2 ) This approach is called empirical risk minimization ( ERM ) . For better optimization performance , the loss function ` is commonly chosen to be smooth . Hence , 0-1 and margin losses are replaced by smooth surrogate loss functions such as the cross-entropy loss . However , we still use the margin loss as defined in ( 1 ) for evaluating the test and generalization performance of DNN classifiers . While ERM training usually achieves good performance over DNNs , several recent observations reveal that adding some adversarially-chosen perturbation to each sample can significantly drop the trained DNN ’ s performance . Given norm function ‖ · ‖ and adversarial noise power > 0 , the adversarial additive noise for sample ( x , y ) and classifier fw is defined to be δadvw ( x ) : = argmax ‖δ‖≤ ` ( fw ( x + δ ) , y ) . ( 3 ) To provide adversarial robustness against the above attack scheme , a standard technique , which is called adversarial training , follows ERM training over the adversarially-perturbed samples by solving min w∈W 1 n n∑ i=1 ` ( fw ( xi + δ adv w ( xi ) ) , yi ) : = min w∈W 1 n n∑ i=1 max ‖δi‖≤ ` ( fw ( xi + δi ) , yi ) . ( 4 ) However , ( 3 ) and ( 4 ) are intractable optimization problems . Therefore , several schemes have been proposed in the literature to approximate the optimal solution of ( 3 ) . In this work , we analyze the generalization performance of the following three gradient-based methods for approximating the solution to ( 3 ) . We note that several other attack schemes such as DeepFool ( Moosavi Dezfooli et al. , 2016 ) , CW attacks ( Carlini & Wagner , 2017 ) , target and least-likely attacks ( Kurakin et al. , 2016 ) have been introduced and examined in the literature , which can lead to interesting future directions for this work . 1 . Fast Gradient Method ( FGM ) ( Goodfellow et al. , 2014b ) : FGM approximates the solution to ( 3 ) by considering a linearized DNN loss around a given data point . Hence , FGM perturbs ( x , y ) by adding the following noise vector : δfgmw ( x ) : = argmax ‖δ‖≤ δT∇x ` ( fw ( x ) , y ) . ( 5 ) For the special case of ` ∞-norm ‖ · ‖∞ , the above representation of FGM recovers the fast gradient sign method ( FGSM ) where each data point ( x , y ) is perturbed by the -normalized sign vector of the loss ’ s gradient . For ` 2-norm ‖ · ‖2 , we similarly normalize the loss ’ s gradient vector to have Euclidean norm . 2 . Projected Gradient Method ( PGM ) ( Kurakin et al. , 2016 ) : PGM is the iterative version of FGM and applies projected gradient descent to solve ( 3 ) . PGM follows the following update rules for a given r number of steps : ∀1 ≤ i ≤ r : δpgm , i+1w ( x ) : = ∏ B , ‖·‖ ( 0 ) { δpgm , iw ( x ) + αν ( i ) w } , ( 6 ) ν ( i ) w : = argmax ‖δ‖≤1 δT∇x ` ( fw ( x + δ pgm , i w ( x ) ) , y ) . Here , we first find the direction ν ( i ) w along which the loss at the ith perturbed point changes the most , and then we move the perturbed point along this direction by stepsize α followed by projecting the resulting perturbation onto the set { δ : ‖δ‖ ≤ } with -bounded norm . 3 . Wasserstein Risk Minimization ( WRM ) ( Sinha et al. , 2018 ) : WRM solves the following variant of ( 3 ) for data-point ( x , y ) where the norm constraint in ( 3 ) is replaced by a norm-squared Lagrangian penalty term : δwrmw ( x ) : = argmax δ ` ( fw ( x + δ ) , y ) − λ 2 ‖δ‖2 . ( 7 ) As discussed earlier , the optimization problem ( 3 ) is generally intractable . However , in the case of Euclidean norm ‖ · ‖2 , if we assume∇x ` ( fw ( x ) , y ) ’ s Lipschitz constant is upper-bounded by λ , then WRM optimization ( 7 ) results in solving a convex optimization problem and can be efficiently solved using gradient methods . To obtain efficient adversarial defense schemes , we can substitute δfgmw , δ pgm w , or δ wrm w for δ adv w in ( 4 ) . Instead of fitting the classifier over true adversarial examples , which are NP-hard to obtain , we can instead train the DNN over FGM , PGM , or WRM-adversarially perturbed samples .

Summary: The paper first provides a generalization bounds for adversarial training, showing that the error bound depends on Lipschitz constant. This motivates the use of spectral regularization (similar to Miyato et al 2018) in adversarial training. Using spectral regularization to improve robustness is not new, but it's interesting to combine spectral regularization and adversarial training. Experimental results show significant improvement over vanilla adversarial training.