Data Augmentation Can Improve Robustness

1 Introduction . Despite their success , neural networks are not intrinsically robust . In particular , it has been shown that the addition of imperceptible deviations to the input , called adversarial perturbations , can cause neural networks to make incorrect predictions with high confidence [ 5 , 6 , 18 , 32 , 49 ] . Starting with Szegedy et al . [ 49 ] , there has been a lot of work on understanding and generating adversarial perturbations [ 2 , 6 ] , and on building defenses that are robust to such perturbations [ 18 , 29 , 34 , 41 ] . Unfortunately , many of the defenses proposed in the literature target failure cases found through specific adversaries , and as such they are easily broken by different adversaries [ 3 , 53 ] . Among successful defenses are robust optimization techniques like the one by Madry et al . [ 34 ] that learns robust models by finding worst-case adversarial perturbations at each training step before adding them to the training data . In fact , adversarial training as proposed by Madry et al . is so effective [ 20 ] that it is the de facto standard for training adversarially robust neural networks . Indeed , since Madry et al . [ 34 ] , various modifications to their original implementation have been proposed [ 20 , 27 , 40 , 44 , 57 , 63 ] . Notably , Carmon et al . [ 7 ] , Hendrycks et al . [ 25 ] , Najafi et al . [ 36 ] , Uesato et al . [ 54 ] , Zhai et al . [ 60 ] showed that using additional data improves adversarial robustness , while Gowal et al . [ 20 ] , Rice et al . [ 44 ] , Wu et al . [ 56 ] found that data augmentation techniques did not boost robustness . This dichotomy motivates this paper . In particular , we explore whether it is possible to fix the training procedure such that data augmentation becomes useful in the setting without additional data . By making the observation that model weight averaging ( WA ) [ 28 ] helps robust generalization to a wider extent when robust overfitting is minimized , we propose to combine model weight averaging with data augmentation techniques . Overall , we make the following contributions : • We demonstrate that , when combined with model weight averaging , data augmentation techniques such as Cutout [ 15 ] , CutMix [ 58 ] and MixUp [ 62 ] can improve robustness . 35th Conference on Neural Information Processing Systems ( NeurIPS 2021 ) . 40 % 50 % 60 % Ro bu st te st a cc ur ac y Madry et al . ( 44.04 % ) Rice et al . ( 53.42 % ) ( Early stopping ) Zhang et al . ( 53.08 % ) ( TRADES ) Gowal et al . ( 57.20 % ) ( Tuning ) Ours ( 60.07 % ) ( Augmentations ) without additional data 2 Related Work . Adversarial ` p-norm attacks . Since Szegedy et al . [ 49 ] observed that neural networks which achieve high accuracy on test data are highly vulnerable to adversarial examples , the art of crafting increasingly sophisticated adversarial examples has received a lot of attention . Goodfellow et al . [ 18 ] proposed the Fast Gradient Sign Method ( FGSM ) which generates adversarial examples with a single normalized gradient step . It was followed by R+FGSM [ 52 ] , which adds a randomization step , and the Basic Iterative Method ( BIM ) [ 32 ] , which takes multiple smaller gradient steps . Adversarial training as a defense . The adversarial training procedure [ 34 ] feeds adversarially perturbed examples back into the training data . It is widely regarded as one of the most successful method to train robust deep neural networks . It has been augmented in different ways – with changes in the attack procedure ( e.g. , by incorporating momentum [ 16 ] ) , loss function ( e.g. , logit pairing [ 35 ] ) or model architecture ( e.g. , feature denoising [ 57 ] ) . Another notable work by Zhang et al . [ 63 ] proposed TRADES , which balances the trade-off between standard and robust accuracy , and achieved state-of-the-art performance against ` ∞ norm-bounded perturbations on CIFAR-10 . More recently , the work from Rice et al . [ 44 ] studied robust overfitting and demonstrated that improvements similar to TRADES could be obtained more easily using classical adversarial training with early stopping . This later study revealed that early stopping was competitive with many other regularization techniques and demonstrated that data augmentation schemes beyond the typical random padding-and-cropping were ineffective on CIFAR-10 . Finally , Gowal et al . [ 20 ] highlighted how different hyper-parameters ( such as network size and model weight averaging ) affect robustness . They were able to obtain models that significantly improved upon the state-of-the-art , but lacked a thorough investigation on data augmentation schemes . Similarly to Rice et al . [ 44 ] , they also make the conclusion that data augmentations beyond random padding-and-cropping do not improve robustness . Data augmentation . Data augmentation has been shown to improve the generalisation of standard ( non-robust ) training . For image classification tasks , random flips , rotations and crops are commonly used [ 23 ] . More sophisticated techniques such as Cutout [ 15 ] ( which produces random occlusions ) , CutMix [ 58 ] ( which replaces parts of an image with another ) and MixUp [ 62 ] ( which linearly interpolates between two images ) all demonstrate extremely compelling results . As such , it is rather surprising that they remain ineffective when training adversarially robust networks [ 20 , 44 , 56 ] . In this work , we revisit these common augmentation techniques in the context of adversarial training . 3 Preliminaries and hypothesis . The rest of this manuscript is organized as follows . In this section , we provide an overview of adversarial training and introduce the hypothesis that model weight averaging works better when robust overfitting is reduced . In section 4 we discuss that data augmentations can be used to verify this hypothesis . Finally , we provide thorough experimental results in section 6 . 3.1 Adversarial training . Madry et al . [ 34 ] formulate a saddle point problem to find model parameters θ that minimize the adversarial risk : argmin θ E ( x , y ) ∼D [ max δ∈S l ( f ( x+ δ ; θ ) , y ) ] ( 1 ) where D is a data distribution over pairs of examples x and corresponding labels y , f ( · ; θ ) is a model parametrized by θ , l is a suitable loss function ( such as the 0− 1 loss in the context of classification tasks ) , and S defines the set of allowed perturbations . For ` p norm-bounded perturbations of size , the adversarial set is defined as Sp = { δ | ‖δ‖p ≤ } . In the rest of this manuscript , we will use p to denote ` p norm-bounded perturbations of size ( e.g. , ∞ = 8/255 ) . To solve the inner optimization problem , Madry et al . [ 34 ] use Projected Gradient Descent ( PGD ) , which replaces the non-differentiable 0−1 loss l with the cross-entropy loss lce and computes an adversarial perturbation δ̂ = δ ( K ) in K gradient ascent steps of size α as δ ( k+1 ) ← projS ( δ ( k ) + α sign ( ∇δ ( k ) lce ( f ( x+ δ ( k ) ; θ ) , y ) ) ) ( 2 ) where δ ( 0 ) is chosen at random within S , and where projA ( a ) projects a point a back onto a set A , projA ( a ) = argmina′∈A‖a− a′‖2 . We refer to this inner optimization with K steps as PGDK . 3.2 Robust overfitting . To the contrary of standard training , which often shows no overfitting in practice [ 61 ] , adversarial training suffers from robust overfitting [ 44 ] . Robust overfitting is the phenomenon by which robust accuracy on the test set quickly degrades while it continues to rise on the train set ( clean accuracy on both sets continues to improve as well ) . Rice et al . [ 44 ] propose to use early stopping as the main contingency against robust overfitting , and demonstrate that it also allows to train models that are more robust than those trained with other regularization techniques ( such as data augmentation or increased ` 2-regularization ) . They observed that some of these other regularization techniques could reduce the impact of overfitting at the cost of producing models that are over-regularized and lack overall robustness and accuracy . There is one notable exception which is the addition of external data [ 7 , 54 ] . Figure 2 ( a ) shows how the robust accuracy ( evaluated on the test set ) evolves as training progresses on CIFAR-10 against ∞ = 8/255 . Without external data , robust overfitting is clearly visible and appears shortly after the learning rate is dropped ( the learning rate is decayed by 10× two-thirds through training in a schedule similar to [ 44 ] and commonly used since [ 34 ] ) . Robust overfitting completely disappears when an additional set of 500K pseudo-labeled images ( see Carmon et al . [ 7 ] ) is introduced . 3.3 Model weight averaging . Model weight averaging ( WA ) [ 28 ] can be implemented using an exponential moving average θ′ of the model parameters θ with a decay rate τ ( i.e. , θ′ ← τ · θ′ + ( 1 − τ ) · θ at each training step ) . During evaluation , the weighted parameters θ′ are used instead of the trained parameters θ. Chen et al . [ 8 ] , Gowal et al . [ 20 ] discovered that model weight averaging can significantly improve robustness on a wide range of models and datasets . Chen et al . [ 8 ] argue ( similarly to [ 56 ] ) that WA leads to a flatter adversarial loss landscape , and thus a smaller robust generalization gap . Gowal et al . [ 20 ] also explain that , in addition to improved robustness , WA reduces sensitivity to early stopping . While this is true , it is important to note that WA is still prone to robust overfitting . This is not surprising , since the exponential moving average “ forgets ” older model parameters as training goes on . Figure 2 ( b ) shows how the robust accuracy evolves as training progresses when using WA . We observe that , after the change of learning rate , the averaged weights are increasingly affected by overfitting , thus resulting in worse robust accuracy for the averaged model . step20 % 50 % 60 % Ro bu st te st a cc ur ac y without external data with external data ( a ) Adversarial training with and without additional data from 80M-TI ( without WA ) step20 % 50 % 60 % Ro bu st te st a cc ur ac y without WA with WA ( b ) Effect of WA without external data step20 % 50 % 60 % Ro bu st te st a cc ur ac y without WA with WA ( c ) Effect of WA with external data

Summary: The main result of this paper is that some kinds of data augmentation can boost adversarial robustness when combined with model weight averaging. Prior work investigating data augmentation does not perform weight averaging, and reported that data augmentation wasn't useful. This paper reports empirical gains on common benchmarks with CutMix augmentation, and run some experiments to see where the gains in model weight averaging are coming from, the effect of unlabeled data, generalization across different architectures etc.