Domain Invariant Adversarial Learning

1 INTRODUCTION . Deep learning models have achieved impressive success on a wide range of challenging tasks . However , their performance was shown to be brittle to adversarial examples : small , imperceptible perturbations in the input that drastically alter the classification ( Carlini & Wagner , 2017a ; b ; Goodfellow et al. , 2014 ; Kurakin et al. , 2016b ; Moosavi-Dezfooli et al. , 2016 ; Szegedy et al. , 2013 ; Tramèr et al. , 2017 ; Dong et al. , 2018 ; Tabacof & Valle , 2016 ; Xie et al. , 2019b ; Rony et al. , 2019 ) . Designing reliable robust models has gained significant attention in the arms race against adversarial examples . Adversarial training ( Szegedy et al. , 2013 ; Goodfellow et al. , 2014 ; Madry et al. , 2017 ; Zhang et al. , 2019b ) has been suggested as one of the most effective approaches to defend against such examples , and can be described as solving the following min-max optimization problem : min θ E ( x , y ) ∼D [ max x′ : ‖x′−x‖p≤ ` ( x′ , y ; θ ) ] , where x′ is the -bounded perturbation in the ` p norm and ` is the loss function . Different unrestricted attacks methods were also suggested , such as adversarial deformation , rotations , translation and more ( Brown et al. , 2018 ; Engstrom et al. , 2018 ; Xiao et al. , 2018 ; Alaifari et al. , 2018 ; Gilmer et al. , 2018 ) . The resulting min-max optimization problem can be hard to solve in general . Nevertheless , in the context of -bounded perturbations , the problem is often tractable in practice . The inner maximization is usually approximated by generating adversarial examples using projected gradient descent ( PGD ) ( Kurakin et al. , 2016a ; Madry et al. , 2017 ) . A PGD adversary starts with randomly initialized perturbation and iteratively adjust the perturbation while projecting it back into the -ball : xt+1 = ΠB ( x0 ) ( xt + α · sign ( ∇xt ` ( G ( xt ) , y ) ) ) , where x0 is the natural example ( with or without random noise ) , and ΠB ( x ) is the projection operator onto the -ball , G is the network , and α is the perturbation step size . As was shown by Athalye et al . ( 2018 ) , PGD-based adversarial training was one of the few defenses that were not broken under strong attacks . That said , the gap between robust and natural accuracy remains large for many tasks such as CIFAR10 ( Krizhevsky et al. , 2009 ) and ImageNet ( Deng et al. , 2009 ) . Generally speaking , Tsipras et al . ( 2018 ) suggested that robustness may be at odds with natural accuracy , and usually the trade-off is inherent . Nevertheless , a growing body of work aimed to improve the standard PGD-based adversarial training introduced by Madry et al . ( 2017 ) in various ways such as improved adversarial loss functions and regularization techniques ( Kannan et al. , 2018 ; Wang et al. , 2019b ; Zhang et al. , 2019b ) , semi-supervised approaches ( Carmon et al. , 2019 ; Uesato et al. , 2019 ; Zhai et al. , 2019 ) , adversarial perturbations on model weights ( Wu et al. , 2020 ) , utilizing out of distribution data ( Lee et al. , 2021 ) and many others . See related work for more details . Our contribution . In this work , we propose a novel approach to regulating the tradeoff between robustness and natural accuracy . In contrast to the aforementioned works , our method enhances adversarial training by enforcing a feature representation that is invariant across the natural and adversarial domains . We incorporate the idea of Domain-Adversarial Neural Networks ( DANN ) ( Ganin & Lempitsky , 2015 ; Ganin et al. , 2016 ) directly into the adversarial training process . DANN is a representation learning approach for domain adaptation , designed to ensure that predictions are made based on invariant feature representation that can not discriminate between source and target domains . Intuitively , the tasks of adversarial training and of domain-invariant representation have a similar goal : given a source ( natural ) domainX and a the target ( adversarial ) domainX ′ , we hope to achieve g ( X ) ≈ g ( X ′ ) , where g a feature representation function ( i.e. , neural network ) . Achieving such a dual representation intuitively yields a more general feature representation . In a comprehensive battery of experiments on MNIST ( LeCun et al. , 1998 ) , SVHN ( Netzer et al. , 2011 ) , CIFAR-10 ( Krizhevsky et al. , 2009 ) and CIFAR-100 ( Krizhevsky et al. , 2009 ) datasets , we demonstrate that by enforcing domain-invariant representation learning using DANN simultaneously with adversarial training , we gain a significant and consistent improvement in both robustness and natural accuracy compared to other state-of-the-art adversarial training methods , under AutoAttack ( Croce & Hein , 2020 ) and various strong PGD ( Madry et al. , 2017 ) , CW ( Carlini & Wagner , 2017b ) adversaries in white-box and black-box settings . Additionally , we evaluate our method using unforeseen `` natural '' corruptions ( Hendrycks & Dietterich , 2018 ) , unforeseen adversaries ( e.g. , ` 1 , ` 2 ) , transfer learning , and perform ablation studies . Finally , we offer a novel score function for quantifying the robust-natural accuracy tradeoff . 2 RELATED WORK . 2.1 DEFENSE METHODS . A variety of theoretically principled ( Cohen et al. , 2019 ; Raghunathan et al. , 2018a ; Sinha et al. , 2017 ; Raghunathan et al. , 2018b ; Wong et al. , 2018 ; Wong & Kolter , 2018 ; Gowal et al. , 2018 ) and empirical defense approaches ( Bai et al. , 2021 ) were proposed to enhance robustness since the discovery of adversarial examples . Among the empirical defence techniques we can find adversarial regularization ( Kurakin et al. , 2016a ; Madry et al. , 2017 ; Zhang et al. , 2019b ; Wang et al. , 2019b ; Kannan et al. , 2018 ) , curriculum-based adversarial training ( Cai et al. , 2018 ; Zhang et al. , 2020 ; Wang et al. , 2019a ) , ensemble adversarial training ( Tramèr et al. , 2017 ; Pang et al. , 2019 ; Yang et al. , 2020 ) , adversarial training with adaptive attack budget ( Ding et al. , 2018 ; Cheng et al. , 2020 ) , semi-supervised and unsupervised adversarial training ( Carmon et al. , 2019 ; Uesato et al. , 2019 ; Zhai et al. , 2019 ) , robust self/pre-training ( Jiang et al. , 2020 ; Chen et al. , 2020 ) , efficient adversarial training ( Shafahi et al. , 2019 ; Wong et al. , 2020 ; Andriushchenko & Flammarion , 2020 ; Zhang et al. , 2019a ) , and many other techniques ( Zhang & Wang , 2019 ; Goldblum et al. , 2020 ; Pang et al. , 2020b ; Lee et al. , 2020 ) . In an additional research direction , researchers suggested to add new dedicated building blocks to the network architecture for improved robustness ( Xie & Yuille , 2019 ; Xie et al. , 2019a ; Liu et al. , 2020 ) . Liu et al . ( 2020 ) hypothesised that different adversaries belong to different domains , and suggested gated batch normalization which is trained with multiple perturbation types . Others focused on searching robust architectures against adversarial examples ( Guo et al. , 2020 ) . Our work belongs to the the family of adversarial regularization techniques , for which we elaborate on common and best performing methods , and highlight the differences compared to our method . Madry et al . ( 2017 ) proposed a technique , commonly referred to as Adversarial Training ( AT ) , to minimize the cross entropy loss on adversarial examples generated by PGD . Zhang et al . ( 2019b ) suggested to decompose the prediction error for adversarial examples as the sum of the natural error and boundary error , and provided a differentiable upper bounds on both terms . Motivated by this decomposition , they suggested a technique called TRADES that uses the Kullback-Leibler ( KL ) divergence as a regularization term that will push the decision boundary away from the data . Wang et al . ( 2019b ) suggested that misclassified examples have a significant impact on final robustness , and proposed a technique called MART that differentiate between correctly classified and missclassified examples during training . Another area of research aims at revealing the connection between the loss weight landscape and adversarial training ( Prabhu et al. , 2019 ; Yu et al. , 2018 ; Wu et al. , 2020 ) . Specifically , Wu et al . ( 2020 ) identified a correlation between the flatness of weight loss landscape and robust generalization gap . They proposed the Adversarial Weight Perturbation ( AWP ) mechanism that is integrated into existing adversarial training methods . More recently , this approach was formalized from a theoretical standpoint by Tsai et al . ( 2021 ) . However , this method forms a double-perturbation mechanism that perturbs both inputs and weights , which may incur a significant increase in calculation overhead . Nevertheless , we show that DIAL still improves state-of-the-art results when combined with AWP . A related approach to ours , called ATDA , was presented by Song et al . ( 2018 ) . They proposed to add several constrains to the loss function in order to enforce domain adaptation : correlation alignment and maximum mean discrepancy ( Borgwardt et al. , 2006 ; Sun & Saenko , 2016 ) . While the objective is similar , using ideas from domain adaptation for learning better representation , we address it in two different ways . Our method fundamentally differs from Song et al . ( 2018 ) since we do not enforce domain adaptation by adding specific constrains to the loss function . Instead , we let the network learn the domain invariant representation directly during the optimization process , as suggested by Ganin & Lempitsky ( 2015 ) ; Ganin et al . ( 2016 ) . Moreover , Song et al . ( 2018 ) focused mainly of FGSM . We empirically demonstrate the superiority of our method in Section 4 . In a concurrent work , Qian et al . ( 2021 ) utilized the idea of exploiting local and global data information , and suggested to generate the adversarial examples by attacking an additional domain classifier . 2.2 ROBUST GENERALIZATION . Several works investigated the sample complexity requires the ensure adversarial generalization compared to the non-adversarial counterpart . Schmidt et al . ( 2018 ) has shown that there exists a distribution ( mixture of Gaussians ) where ensuring robust generalization necessarily requires more data than standard learning . This has been furthered investigated in a distribution-free models via the Rademacher Complexity , VC-dimension ( Yin et al. , 2019 ; Attias et al. , 2019 ; Khim & Loh , 2018 ; Awasthi et al. , 2020 ; Cullina et al. , 2018 ; Montasser et al. , 2019 ; Tsai et al. , 2021 ) and additional settings ( Diochnos et al. , 2018 ; Carmon et al. , 2019 ) .

Summary: This paper proposes a domain invariant adversarial training (DIAL) method, which learns the feature representation that is both robust and domain invariant.  Apart from the label classifier, the model is equipped with a domain classifier that constrains the model not to discriminate between natural examples and adversarial examples, thus achieving a more robust feature representation. Extensive experiments on image classification benchmark the robustness compared to other state-of-the-art methods.