Resilience to Multiple Attacks via Adversarially Trained MIMO Ensembles

1 INTRODUCTION . The arms race between attacks and defenses against DNNs has created a diversity of attack types . These include black-box vs white-box attacks and gradient-based vs gradient-free attacks . Ideally , adversarially robust models would be robust against all types of attack . Many defenses have been developed to protect DNNs from adversarial attacks . For instance , gradient masking [ 21 ] , input denoising [ 33 , 15 ] , and hidden layer randomization [ 16 ] , are three techniques that in their time were heralded as strong defense techniques . However , [ 1 , 3 , 28 ] show that all of the above methods fail against adaptive adversaries , i.e. , perturbations crafted with full knowledge of the defense measure . Among all attempts to make the deep model resilient , Adversarial Training ( AT ) [ 17 ] has stood the test of time and is regarded as the gold standard for its resilience to white-box adversaries [ 18 ] . AT trains the deep models with adversarial examples instead of with benign training examples . Due to its empirical robustness , this method remains state-of-the-art against a wide range of attacks . However , AT suffers from two fundamental drawbacks . First , it is computationally expensive , specifically the method to generate effective AEs . Second , the choice of attack type used during training significantly affects the type of robustness that is observed . For example , previous work [ 27 , 22 ] shows that the model adversarial trained using the ` ∞ attack is robust against ` 1 and ` 2 PGD attacks but vulnerable against gradient-free attacks . This phenomenon reveals that the robustness of adversarial training implicitly masks out the gradient information for ` 1 and ` 2 attacks . Previous works [ 27 , 18 ] try to revise adversarial training by training the model using the worst case of PGD adversarial examples among different attack metrics and achieve better results . MSD [ 18 ] revises the Tramèr and Boneh ’ s method [ 27 ] by calculating ` 1 , ` 2 , ` ∞ attacks for each step of PGD iteration and updates with the one that achieves the largest loss . This method achieved better performance against ` 1 , ` 2 , ` ∞ attacks . However , though MSD is faster than [ 27 ] , it still requires multiple forward passes for each step of the PGD attack , which makes it more expensive to train comparing to the standard AT . As ensemble methods have proven to be effective in robustness to random perturbations ( i.e. , , the average case ) , one natural idea to improve adversarial robustness is to exploit ensemble methods ( or model averaging ) . Ensemble methods combine the predictions of sub-models based on some vote functions ( like averaging or majority vote ) . Previous attempts of using ensemble methods for adversarial robustness have been shown to be vulnerable under strong adversaries [ 35 , 19 , 23 , 29 , 10 ] . They mainly failed for two reasons [ 34 ] . First , if the ensemble is diverse but the models are weak ( i.e. , not adversarially robust ) , an adaptive attack only needs to find a single AE that lies in the intersection of the AE space of the sub-models ( i.e. , a single worst case ) , which is easy [ 10 ] . Intuitively , this finds a single perturbation that is a “ common mistake ” across sub-models . Second , adversarial examples tends to transfer between similar models , i.e. , the adversarial perturbation generated from one sub-model may easily mislead another sub-model especially when they share the similar training set or architecture [ 20 ] ; and the transferability of attacks remains true even if the sub-models are adversarially robust themselves ( see vanilla ensemble models in 4.2 of the experiments ) . Thus , neither diversity of the models nor adversarial robustness of each of the sub-models by themselves can improve adversarial robustness . To overcome these two prior failures of ensemble methods , we propose to encourage adversarial diversity which is defined to have two key features simultaneously : 1 ) adversarial robustness of each sub-model and 2 ) robustness against transfer attacks between sub-models . Additionally , we would like to do this with minimal computational overhead because AT is already very computationally expensive . Our approach is inspired by a recent work called multi-input-multi-output ( MIMO ) training [ 8 ] . MIMO can train M sub-models simultaneously to form a diverse ensemble , and crucially the training time of the ensemble is almost the same as that of a single model . In this work , we show that by combining MIMO configuration with AT , it is possible to attain robustness against multiple attack types with an adversarially diverse ensemble , i.e. , we can achieve adversarial diversity . The results in § 4.1 shows that by sharing model parameters , the sub-models act as an implicit way of bringing adversarial diversity while also remaining robust . Then in § 4.2 , we present that our MAT adversarially trained with each sub-model bestowing resilience to a particular attack metric leads to robustness against multiple types of perturbations . We achieve robustness accuracy ( 82.3 % , 57.1 % , 71.6 % ) against ( ` ∞ , ` 2 , ` 1 ) attack with epsilon ( 10 , 2 , 0.3 ) on MNIST . On CIFAR10 dataset , our model achieves robustness accuracy ( 47.9 % , 61.8 % , 47.6 % ) against ( ` 1 , ` 2 , ` ∞ ) attack with radius ( 12 , 0.5 , 0.03 ) . Finally , in § F , we provide an alternative application that one can utilize our MIMO+AT ( MAT ) by training the MAT with all sub-models trained with the same attack to strengthen previous AT methods to achieve better adversarial robustness without loss of clean accuracy . We provide three examples in this section as ` ∞ AT , ` 2 AT , and MSD . We summarize our contributions as follows : 1 . We shed light on why prior ensemble methods may fail and hypothesize that ensemble methods can improve adversarial robustness if they are adversarially diverse , which is defined by two properties : 1 ) the sub-models are adversarially robust themselves and yet 2 ) adversarial attacks do not transfer easily between sub-models . 2.We propose to use MIMO AT ( MAT ) to train such an ensemble in a computationally efficient way and discuss how the cross-gradient information between the sub-models during training can increase the robustness to transfer attacks between models . 3 . We empirically demonstrate that MAT is adversarially diverse and improves significantly over AT models and vanilla ensembles while being comparable or better than prior state-of-the-art methods for multi-attack robustness . 2 PRELIMINARY . In this section , we review some key concepts related to adversarial attacks , adversarial training ( AT ) , and MIMO structure , all the notations defined here will be used throughout the paper . PGD Adversarial Attacks . PGD attacks seek a point x′ in a neighborhood of the benign example x with perturbation δ , which maximizes the loss L. x′ is generated as : x′ = x+arg maxδ∈B‖·‖p ( ) L ( fθ ( x+δ ) , y ∗ ) , where denotes the attack radius , fθ is the DNN with parameter θ , y∗ is the true label . Denote the perturbation δ = x′ − x . A general PGD attack adopts gradient-type algorithm to update δ as δ ( t+1 ) = ΠB‖·‖p ( ) ( δ ( t ) + α · Vp ( ∇xL ( fθ ( x ) , y∗ ) ) ) , with Vp ( δ ) = arg max v∈B‖·‖p ( 1 ) v > δ . ( 1 ) where p is the attack metric ( usually ` p norm ) , α is the step size , Π is the operator projecting the gradient onto the ` p ball with radius ( denoted by B‖·‖p ( ) ) , Vp is the operator mapping the gradient to the steepest descent direction on the ` p ball with radius 1 . Note that Vp is a fundamentally different operator than Π , and in the case of the p = ∞ , V∞ reduces to the sign of the gradient ( as in the FGSM attack ) . Intuitively , PGD adversarial attack uses iterate with a fixed step size α along the steepest direction Vp ( ∇xL ( fθ ( x ) , y∗ ) ) . FGSM [ 7 ] , BIM [ 13 ] and [ 17 ] can all be treated as variants of the PGD Attack . Adversarial Training . AT is regarded as one of the most practical yet effective methods for defending against adversarial attacks . This has stood the “ test of time '' through multiple iterations of proposed defenses and attacks that discover vulnerabilities in them . AT seeks to build a robust model against adversarial attacks by producing adversarial examples and injecting them into training data by solving a saddle point optimization problem θ∗ = arg min θ ∑ i max δi∈B‖·‖p ( ) L ( fθ ( xi + δi ) , y∗i ) . ( 2 ) Here i denote the i-th batch number of training set ( xi , y∗i ) . The inner maximization seeks to find the adversarial directions δi given the current classifier fθ , and the outer minimization tries to find the best θ to minimize the summation of all batches ’ loss . PGD AT is widely accepted as a standard approximation of inner maximization methods since it is a universal first-order attack algorithm [ 17 ] . Though it roughly needs K + 1 times more computation compared to standard training , PGD-AT remains the de facto standard for AT since it walks the balance between strength of attack and computational cost of generating adversarial examples . The drawback of AT is that solving the inner maximization requires a pre-defined attack metric p , which only contributes to robustness under ` p attacks . [ 27 ] . In this paper , we show how the adversarial robustness can be achieved through AT but crucially , one can generalize the defense to multiple attack types and achieve this at about the exact cost as AT . MIMO Ensemble . Ensemble methods have been widely used to improve a model ’ s calibration and robustness over out-of-distribution samples by averaging over multiple neural network predictions [ 8 , 31 , 32 ] . However , ensemble over M deep models ( sub-models ) is usually M times more expensive from a computational and a memory standpoint . Furthermore , to improve uncertainty estimation , sub-models often sacrifice individual performance to achieve diversified predictions . To address the computational drawbacks of vanilla ensembles , [ 8 ] proposed an ensemble structure called MIMO Ensemble . It showed a surprising result : the benefits of using multiple predictions can be achieved ‘ for free ’ under a single model ’ s forward pass . In particular , they showed that , using a multi-input multioutput ( MIMO ) configuration , one can utilize a single model ’ s capacity to train multiple sub-models that independently learn the task at hand . Since all the layers are shared except for the input layer and the output layer , this architecture uses only about 1 % more parameters . Training a MIMO model has almost the same time complexity as training a standard model while keeping the sub-models diverse without any special regularization and parameter tuning . During training , MIMO uses gradient method to solve following optimization problem for M sub-models . minimize θ ∑ i M∑ m=1 L ( fθ ( xi,1 , ... , xi , M ) m︸ ︷︷ ︸ yi , m , y∗i , m ) , ( 3 ) where ( xi,1 , ... xi , M ) are i.i.d sampled from the training set , with xi , m denoting the input of the i-th batch for the m-th subnetwork , yi , m , y∗i , m represent the outputs from the model and the ground truth respectively , and L is the cross entropy loss . Notice that the overall objective is the summation of each sub-model ’ s loss . The separation structure promotes the sub-models ’ prediction to be less correlated because the output yj is independent to xi when i 6= j . During testing , the same inputs are copied and fed to all the M sub-models , then MIMO decides the prediction by averaging yi , m . 3 OUR APPROACH : MAT Given the weaknesses of prior ensemble methods , we seek an algorithm that produces an adversarially diverse ensemble , where the sub-models are robust to the attacks transferred from other sub-models so that the ensemble can have better robustness comparing to single sub-model . To achieve this , we propose to combine MIMO and AT , an approach we call MAT . There are two difficulties to overcome in adversarially training an ensemble model : 1 ) For the outer minimization , how should one choose the loss function to update the sub-model parameters θ ? To be specific , choosing a single sub-model loss or the ensemble loss ? 2 ) For the inner maximization , how should the adversarial examples x′1 , . . . , x ′ M be created during training ? To solve ( 1 ) , [ 8 ] demonstrates that taking the gradient with respect to the ensemble loss contributes to higher clean accuracy and is more computationally efficient . Therefore , we choose to update parameter θ using SGD , where the gradient is taken with respect to the ensemble loss instead of the loss of each sub-model . To tackle ( 2 ) , one natural choice is taking gradient with respect to each sub-model ’ s loss as in standard AT on each sub-model . However , we show in Sec . 3.2 that taking gradients with respect to the ensemble loss produces sub-models that re more robust to transfer attacks and , furthermore , it is more computationally efficient . Therefore , in the inner maximization , we generate adversarial examples by algorithms that compute gradients with respect to the ensemble loss instead of each sub-model ’ s loss . We explore these two choices in more detail in the next two sections .

Summary: In this work, the authors propose a new training algorithm MAT that adversarially trains Multi Input Multi Output (MIMO) models. They show that ensemble models based on MIMO when trained adversarially , show ``adversarial diversity'' and therefore are less vulnerable to transfer attacks. They empirically demonstrate that such models are robust to a variety of $\ell_1, \ell_\infty$ and $\ell_2$ attacks and achieve better performance than other methods claiming robustness across different threat models. The authors also show computational benefits of their algorithm over vanilla ensemble training.