Resilience to Multiple Attacks via Adversarially Trained MIMO Ensembles

1 INTRODUCTION . The arms race between attacks and defenses against DNNs has created a diversity of attack types . These include black-box vs white-box attacks and gradient-based vs gradient-free attacks . Ideally , adversarially robust models would be robust against all types of attack . Many defenses have been developed to protect DNNs from adversarial attacks . For instance , gradient masking [ 21 ] , input denoising [ 33 , 15 ] , and hidden layer randomization [ 16 ] , are three techniques that in their time were heralded as strong defense techniques . However , [ 1 , 3 , 28 ] show that all of the above methods fail against adaptive adversaries , i.e. , perturbations crafted with full knowledge of the defense measure . Among all attempts to make the deep model resilient , Adversarial Training ( AT ) [ 17 ] has stood the test of time and is regarded as the gold standard for its resilience to white-box adversaries [ 18 ] . AT trains the deep models with adversarial examples instead of with benign training examples . Due to its empirical robustness , this method remains state-of-the-art against a wide range of attacks . However , AT suffers from two fundamental drawbacks . First , it is computationally expensive , specifically the method to generate effective AEs . Second , the choice of attack type used during training significantly affects the type of robustness that is observed . For example , previous work [ 27 , 22 ] shows that the model adversarial trained using the ` ∞ attack is robust against ` 1 and ` 2 PGD attacks but vulnerable against gradient-free attacks . This phenomenon reveals that the robustness of adversarial training implicitly masks out the gradient information for ` 1 and ` 2 attacks . Previous works [ 27 , 18 ] try to revise adversarial training by training the model using the worst case of PGD adversarial examples among different attack metrics and achieve better results . MSD [ 18 ] revises the Tramèr and Boneh ’ s method [ 27 ] by calculating ` 1 , ` 2 , ` ∞ attacks for each step of PGD iteration and updates with the one that achieves the largest loss . This method achieved better performance against ` 1 , ` 2 , ` ∞ attacks . However , though MSD is faster than [ 27 ] , it still requires multiple forward passes for each step of the PGD attack , which makes it more expensive to train comparing to the standard AT . As ensemble methods have proven to be effective in robustness to random perturbations ( i.e. , , the average case ) , one natural idea to improve adversarial robustness is to exploit ensemble methods ( or model averaging ) . Ensemble methods combine the predictions of sub-models based on some vote functions ( like averaging or majority vote ) . Previous attempts of using ensemble methods for adversarial robustness have been shown to be vulnerable under strong adversaries [ 35 , 19 , 23 , 29 , 10 ] . They mainly failed for two reasons [ 34 ] . First , if the ensemble is diverse but the models are weak ( i.e. , not adversarially robust ) , an adaptive attack only needs to find a single AE that lies in the intersection of the AE space of the sub-models ( i.e. , a single worst case ) , which is easy [ 10 ] . Intuitively , this finds a single perturbation that is a “ common mistake ” across sub-models . Second , adversarial examples tends to transfer between similar models , i.e. , the adversarial perturbation generated from one sub-model may easily mislead another sub-model especially when they share the similar training set or architecture [ 20 ] ; and the transferability of attacks remains true even if the sub-models are adversarially robust themselves ( see vanilla ensemble models in 4.2 of the experiments ) . Thus , neither diversity of the models nor adversarial robustness of each of the sub-models by themselves can improve adversarial robustness . To overcome these two prior failures of ensemble methods , we propose to encourage adversarial diversity which is defined to have two key features simultaneously : 1 ) adversarial robustness of each sub-model and 2 ) robustness against transfer attacks between sub-models . Additionally , we would like to do this with minimal computational overhead because AT is already very computationally expensive . Our approach is inspired by a recent work called multi-input-multi-output ( MIMO ) training [ 8 ] . MIMO can train M sub-models simultaneously to form a diverse ensemble , and crucially the training time of the ensemble is almost the same as that of a single model . In this work , we show that by combining MIMO configuration with AT , it is possible to attain robustness against multiple attack types with an adversarially diverse ensemble , i.e. , we can achieve adversarial diversity . The results in § 4.1 shows that by sharing model parameters , the sub-models act as an implicit way of bringing adversarial diversity while also remaining robust . Then in § 4.2 , we present that our MAT adversarially trained with each sub-model bestowing resilience to a particular attack metric leads to robustness against multiple types of perturbations . We achieve robustness accuracy ( 82.3 % , 57.1 % , 71.6 % ) against ( ` ∞ , ` 2 , ` 1 ) attack with epsilon ( 10 , 2 , 0.3 ) on MNIST . On CIFAR10 dataset , our model achieves robustness accuracy ( 47.9 % , 61.8 % , 47.6 % ) against ( ` 1 , ` 2 , ` ∞ ) attack with radius ( 12 , 0.5 , 0.03 ) . Finally , in § F , we provide an alternative application that one can utilize our MIMO+AT ( MAT ) by training the MAT with all sub-models trained with the same attack to strengthen previous AT methods to achieve better adversarial robustness without loss of clean accuracy . We provide three examples in this section as ` ∞ AT , ` 2 AT , and MSD . We summarize our contributions as follows : 1 . We shed light on why prior ensemble methods may fail and hypothesize that ensemble methods can improve adversarial robustness if they are adversarially diverse , which is defined by two properties : 1 ) the sub-models are adversarially robust themselves and yet 2 ) adversarial attacks do not transfer easily between sub-models . 2.We propose to use MIMO AT ( MAT ) to train such an ensemble in a computationally efficient way and discuss how the cross-gradient information between the sub-models during training can increase the robustness to transfer attacks between models . 3 . We empirically demonstrate that MAT is adversarially diverse and improves significantly over AT models and vanilla ensembles while being comparable or better than prior state-of-the-art methods for multi-attack robustness . 2 PRELIMINARY . In this section , we review some key concepts related to adversarial attacks , adversarial training ( AT ) , and MIMO structure , all the notations defined here will be used throughout the paper . PGD Adversarial Attacks . PGD attacks seek a point x′ in a neighborhood of the benign example x with perturbation δ , which maximizes the loss L. x′ is generated as : x′ = x+arg maxδ∈B‖·‖p ( ) L ( fθ ( x+δ ) , y ∗ ) , where denotes the attack radius , fθ is the DNN with parameter θ , y∗ is the true label . Denote the perturbation δ = x′ − x . A general PGD attack adopts gradient-type algorithm to update δ as δ ( t+1 ) = ΠB‖·‖p ( ) ( δ ( t ) + α · Vp ( ∇xL ( fθ ( x ) , y∗ ) ) ) , with Vp ( δ ) = arg max v∈B‖·‖p ( 1 ) v > δ . ( 1 ) where p is the attack metric ( usually ` p norm ) , α is the step size , Π is the operator projecting the gradient onto the ` p ball with radius ( denoted by B‖·‖p ( ) ) , Vp is the operator mapping the gradient to the steepest descent direction on the ` p ball with radius 1 . Note that Vp is a fundamentally different operator than Π , and in the case of the p = ∞ , V∞ reduces to the sign of the gradient ( as in the FGSM attack ) . Intuitively , PGD adversarial attack uses iterate with a fixed step size α along the steepest direction Vp ( ∇xL ( fθ ( x ) , y∗ ) ) . FGSM [ 7 ] , BIM [ 13 ] and [ 17 ] can all be treated as variants of the PGD Attack . Adversarial Training . AT is regarded as one of the most practical yet effective methods for defending against adversarial attacks . This has stood the “ test of time '' through multiple iterations of proposed defenses and attacks that discover vulnerabilities in them . AT seeks to build a robust model against adversarial attacks by producing adversarial examples and injecting them into training data by solving a saddle point optimization problem θ∗ = arg min θ ∑ i max δi∈B‖·‖p ( ) L ( fθ ( xi + δi ) , y∗i ) . ( 2 ) Here i denote the i-th batch number of training set ( xi , y∗i ) . The inner maximization seeks to find the adversarial directions δi given the current classifier fθ , and the outer minimization tries to find the best θ to minimize the summation of all batches ’ loss . PGD AT is widely accepted as a standard approximation of inner maximization methods since it is a universal first-order attack algorithm [ 17 ] . Though it roughly needs K + 1 times more computation compared to standard training , PGD-AT remains the de facto standard for AT since it walks the balance between strength of attack and computational cost of generating adversarial examples . The drawback of AT is that solving the inner maximization requires a pre-defined attack metric p , which only contributes to robustness under ` p attacks . [ 27 ] . In this paper , we show how the adversarial robustness can be achieved through AT but crucially , one can generalize the defense to multiple attack types and achieve this at about the exact cost as AT . MIMO Ensemble . Ensemble methods have been widely used to improve a model ’ s calibration and robustness over out-of-distribution samples by averaging over multiple neural network predictions [ 8 , 31 , 32 ] . However , ensemble over M deep models ( sub-models ) is usually M times more expensive from a computational and a memory standpoint . Furthermore , to improve uncertainty estimation , sub-models often sacrifice individual performance to achieve diversified predictions . To address the computational drawbacks of vanilla ensembles , [ 8 ] proposed an ensemble structure called MIMO Ensemble . It showed a surprising result : the benefits of using multiple predictions can be achieved ‘ for free ’ under a single model ’ s forward pass . In particular , they showed that , using a multi-input multioutput ( MIMO ) configuration , one can utilize a single model ’ s capacity to train multiple sub-models that independently learn the task at hand . Since all the layers are shared except for the input layer and the output layer , this architecture uses only about 1 % more parameters . Training a MIMO model has almost the same time complexity as training a standard model while keeping the sub-models diverse without any special regularization and parameter tuning . During training , MIMO uses gradient method to solve following optimization problem for M sub-models . minimize θ ∑ i M∑ m=1 L ( fθ ( xi,1 , ... , xi , M ) m︸ ︷︷ ︸ yi , m , y∗i , m ) , ( 3 ) where ( xi,1 , ... xi , M ) are i.i.d sampled from the training set , with xi , m denoting the input of the i-th batch for the m-th subnetwork , yi , m , y∗i , m represent the outputs from the model and the ground truth respectively , and L is the cross entropy loss . Notice that the overall objective is the summation of each sub-model ’ s loss . The separation structure promotes the sub-models ’ prediction to be less correlated because the output yj is independent to xi when i 6= j . During testing , the same inputs are copied and fed to all the M sub-models , then MIMO decides the prediction by averaging yi , m . 3 OUR APPROACH : MAT Given the weaknesses of prior ensemble methods , we seek an algorithm that produces an adversarially diverse ensemble , where the sub-models are robust to the attacks transferred from other sub-models so that the ensemble can have better robustness comparing to single sub-model . To achieve this , we propose to combine MIMO and AT , an approach we call MAT . There are two difficulties to overcome in adversarially training an ensemble model : 1 ) For the outer minimization , how should one choose the loss function to update the sub-model parameters θ ? To be specific , choosing a single sub-model loss or the ensemble loss ? 2 ) For the inner maximization , how should the adversarial examples x′1 , . . . , x ′ M be created during training ? To solve ( 1 ) , [ 8 ] demonstrates that taking the gradient with respect to the ensemble loss contributes to higher clean accuracy and is more computationally efficient . Therefore , we choose to update parameter θ using SGD , where the gradient is taken with respect to the ensemble loss instead of the loss of each sub-model . To tackle ( 2 ) , one natural choice is taking gradient with respect to each sub-model ’ s loss as in standard AT on each sub-model . However , we show in Sec . 3.2 that taking gradients with respect to the ensemble loss produces sub-models that re more robust to transfer attacks and , furthermore , it is more computationally efficient . Therefore , in the inner maximization , we generate adversarial examples by algorithms that compute gradients with respect to the ensemble loss instead of each sub-model ’ s loss . We explore these two choices in more detail in the next two sections .

Summary: This paper uses ensembles--and more precisely multi-input-multi-output (MIMO) neural networks for computational efficiency---for adversarial training (AT), resulting in a method called MAT, short for MIMO AT. Moreover, the authors investigate how the sub-networks should be trained to increase the overall robustness of the total MIMO model. In particular, the proposed MAT generates the adversarial samples using the gradient with respect to the objective of the ensemble.  The authors demonstrate on MNIST and CIFAR-10 that the proposed method achieves generalization and robustness comparable to existing state-of-the-art methods.