Domain Invariant Adversarial Learning

1 INTRODUCTION . Deep learning models have achieved impressive success on a wide range of challenging tasks . However , their performance was shown to be brittle to adversarial examples : small , imperceptible perturbations in the input that drastically alter the classification ( Carlini & Wagner , 2017a ; b ; Goodfellow et al. , 2014 ; Kurakin et al. , 2016b ; Moosavi-Dezfooli et al. , 2016 ; Szegedy et al. , 2013 ; Tramèr et al. , 2017 ; Dong et al. , 2018 ; Tabacof & Valle , 2016 ; Xie et al. , 2019b ; Rony et al. , 2019 ) . Designing reliable robust models has gained significant attention in the arms race against adversarial examples . Adversarial training ( Szegedy et al. , 2013 ; Goodfellow et al. , 2014 ; Madry et al. , 2017 ; Zhang et al. , 2019b ) has been suggested as one of the most effective approaches to defend against such examples , and can be described as solving the following min-max optimization problem : min θ E ( x , y ) ∼D [ max x′ : ‖x′−x‖p≤ ` ( x′ , y ; θ ) ] , where x′ is the -bounded perturbation in the ` p norm and ` is the loss function . Different unrestricted attacks methods were also suggested , such as adversarial deformation , rotations , translation and more ( Brown et al. , 2018 ; Engstrom et al. , 2018 ; Xiao et al. , 2018 ; Alaifari et al. , 2018 ; Gilmer et al. , 2018 ) . The resulting min-max optimization problem can be hard to solve in general . Nevertheless , in the context of -bounded perturbations , the problem is often tractable in practice . The inner maximization is usually approximated by generating adversarial examples using projected gradient descent ( PGD ) ( Kurakin et al. , 2016a ; Madry et al. , 2017 ) . A PGD adversary starts with randomly initialized perturbation and iteratively adjust the perturbation while projecting it back into the -ball : xt+1 = ΠB ( x0 ) ( xt + α · sign ( ∇xt ` ( G ( xt ) , y ) ) ) , where x0 is the natural example ( with or without random noise ) , and ΠB ( x ) is the projection operator onto the -ball , G is the network , and α is the perturbation step size . As was shown by Athalye et al . ( 2018 ) , PGD-based adversarial training was one of the few defenses that were not broken under strong attacks . That said , the gap between robust and natural accuracy remains large for many tasks such as CIFAR10 ( Krizhevsky et al. , 2009 ) and ImageNet ( Deng et al. , 2009 ) . Generally speaking , Tsipras et al . ( 2018 ) suggested that robustness may be at odds with natural accuracy , and usually the trade-off is inherent . Nevertheless , a growing body of work aimed to improve the standard PGD-based adversarial training introduced by Madry et al . ( 2017 ) in various ways such as improved adversarial loss functions and regularization techniques ( Kannan et al. , 2018 ; Wang et al. , 2019b ; Zhang et al. , 2019b ) , semi-supervised approaches ( Carmon et al. , 2019 ; Uesato et al. , 2019 ; Zhai et al. , 2019 ) , adversarial perturbations on model weights ( Wu et al. , 2020 ) , utilizing out of distribution data ( Lee et al. , 2021 ) and many others . See related work for more details . Our contribution . In this work , we propose a novel approach to regulating the tradeoff between robustness and natural accuracy . In contrast to the aforementioned works , our method enhances adversarial training by enforcing a feature representation that is invariant across the natural and adversarial domains . We incorporate the idea of Domain-Adversarial Neural Networks ( DANN ) ( Ganin & Lempitsky , 2015 ; Ganin et al. , 2016 ) directly into the adversarial training process . DANN is a representation learning approach for domain adaptation , designed to ensure that predictions are made based on invariant feature representation that can not discriminate between source and target domains . Intuitively , the tasks of adversarial training and of domain-invariant representation have a similar goal : given a source ( natural ) domainX and a the target ( adversarial ) domainX ′ , we hope to achieve g ( X ) ≈ g ( X ′ ) , where g a feature representation function ( i.e. , neural network ) . Achieving such a dual representation intuitively yields a more general feature representation . In a comprehensive battery of experiments on MNIST ( LeCun et al. , 1998 ) , SVHN ( Netzer et al. , 2011 ) , CIFAR-10 ( Krizhevsky et al. , 2009 ) and CIFAR-100 ( Krizhevsky et al. , 2009 ) datasets , we demonstrate that by enforcing domain-invariant representation learning using DANN simultaneously with adversarial training , we gain a significant and consistent improvement in both robustness and natural accuracy compared to other state-of-the-art adversarial training methods , under AutoAttack ( Croce & Hein , 2020 ) and various strong PGD ( Madry et al. , 2017 ) , CW ( Carlini & Wagner , 2017b ) adversaries in white-box and black-box settings . Additionally , we evaluate our method using unforeseen `` natural '' corruptions ( Hendrycks & Dietterich , 2018 ) , unforeseen adversaries ( e.g. , ` 1 , ` 2 ) , transfer learning , and perform ablation studies . Finally , we offer a novel score function for quantifying the robust-natural accuracy tradeoff . 2 RELATED WORK . 2.1 DEFENSE METHODS . A variety of theoretically principled ( Cohen et al. , 2019 ; Raghunathan et al. , 2018a ; Sinha et al. , 2017 ; Raghunathan et al. , 2018b ; Wong et al. , 2018 ; Wong & Kolter , 2018 ; Gowal et al. , 2018 ) and empirical defense approaches ( Bai et al. , 2021 ) were proposed to enhance robustness since the discovery of adversarial examples . Among the empirical defence techniques we can find adversarial regularization ( Kurakin et al. , 2016a ; Madry et al. , 2017 ; Zhang et al. , 2019b ; Wang et al. , 2019b ; Kannan et al. , 2018 ) , curriculum-based adversarial training ( Cai et al. , 2018 ; Zhang et al. , 2020 ; Wang et al. , 2019a ) , ensemble adversarial training ( Tramèr et al. , 2017 ; Pang et al. , 2019 ; Yang et al. , 2020 ) , adversarial training with adaptive attack budget ( Ding et al. , 2018 ; Cheng et al. , 2020 ) , semi-supervised and unsupervised adversarial training ( Carmon et al. , 2019 ; Uesato et al. , 2019 ; Zhai et al. , 2019 ) , robust self/pre-training ( Jiang et al. , 2020 ; Chen et al. , 2020 ) , efficient adversarial training ( Shafahi et al. , 2019 ; Wong et al. , 2020 ; Andriushchenko & Flammarion , 2020 ; Zhang et al. , 2019a ) , and many other techniques ( Zhang & Wang , 2019 ; Goldblum et al. , 2020 ; Pang et al. , 2020b ; Lee et al. , 2020 ) . In an additional research direction , researchers suggested to add new dedicated building blocks to the network architecture for improved robustness ( Xie & Yuille , 2019 ; Xie et al. , 2019a ; Liu et al. , 2020 ) . Liu et al . ( 2020 ) hypothesised that different adversaries belong to different domains , and suggested gated batch normalization which is trained with multiple perturbation types . Others focused on searching robust architectures against adversarial examples ( Guo et al. , 2020 ) . Our work belongs to the the family of adversarial regularization techniques , for which we elaborate on common and best performing methods , and highlight the differences compared to our method . Madry et al . ( 2017 ) proposed a technique , commonly referred to as Adversarial Training ( AT ) , to minimize the cross entropy loss on adversarial examples generated by PGD . Zhang et al . ( 2019b ) suggested to decompose the prediction error for adversarial examples as the sum of the natural error and boundary error , and provided a differentiable upper bounds on both terms . Motivated by this decomposition , they suggested a technique called TRADES that uses the Kullback-Leibler ( KL ) divergence as a regularization term that will push the decision boundary away from the data . Wang et al . ( 2019b ) suggested that misclassified examples have a significant impact on final robustness , and proposed a technique called MART that differentiate between correctly classified and missclassified examples during training . Another area of research aims at revealing the connection between the loss weight landscape and adversarial training ( Prabhu et al. , 2019 ; Yu et al. , 2018 ; Wu et al. , 2020 ) . Specifically , Wu et al . ( 2020 ) identified a correlation between the flatness of weight loss landscape and robust generalization gap . They proposed the Adversarial Weight Perturbation ( AWP ) mechanism that is integrated into existing adversarial training methods . More recently , this approach was formalized from a theoretical standpoint by Tsai et al . ( 2021 ) . However , this method forms a double-perturbation mechanism that perturbs both inputs and weights , which may incur a significant increase in calculation overhead . Nevertheless , we show that DIAL still improves state-of-the-art results when combined with AWP . A related approach to ours , called ATDA , was presented by Song et al . ( 2018 ) . They proposed to add several constrains to the loss function in order to enforce domain adaptation : correlation alignment and maximum mean discrepancy ( Borgwardt et al. , 2006 ; Sun & Saenko , 2016 ) . While the objective is similar , using ideas from domain adaptation for learning better representation , we address it in two different ways . Our method fundamentally differs from Song et al . ( 2018 ) since we do not enforce domain adaptation by adding specific constrains to the loss function . Instead , we let the network learn the domain invariant representation directly during the optimization process , as suggested by Ganin & Lempitsky ( 2015 ) ; Ganin et al . ( 2016 ) . Moreover , Song et al . ( 2018 ) focused mainly of FGSM . We empirically demonstrate the superiority of our method in Section 4 . In a concurrent work , Qian et al . ( 2021 ) utilized the idea of exploiting local and global data information , and suggested to generate the adversarial examples by attacking an additional domain classifier . 2.2 ROBUST GENERALIZATION . Several works investigated the sample complexity requires the ensure adversarial generalization compared to the non-adversarial counterpart . Schmidt et al . ( 2018 ) has shown that there exists a distribution ( mixture of Gaussians ) where ensuring robust generalization necessarily requires more data than standard learning . This has been furthered investigated in a distribution-free models via the Rademacher Complexity , VC-dimension ( Yin et al. , 2019 ; Attias et al. , 2019 ; Khim & Loh , 2018 ; Awasthi et al. , 2020 ; Cullina et al. , 2018 ; Montasser et al. , 2019 ; Tsai et al. , 2021 ) and additional settings ( Diochnos et al. , 2018 ; Carmon et al. , 2019 ) .

Summary: The paper describes an adversarial training approach that, in addition to the commonly used robustness loss, requires the network to extract similar representation distributions for clean and attacked data. The proposed method is inspired by domain adaptation approaches that require a model to extract domain invariant/agnostic features from two domains. In the context of this paper, the two domains are the clean and adversarially perturbed images, and the network is required to extract domain invariant representation. To achieve domain invariance, the authors propose a domain classifier ( i.e., an adversarial network) that discriminates the representations from clean and attacked images. The feature extractor is then required to generate features that fool the domain classifier. The authors then provide extensive experiments on small-scale benchmark datasets (SVHN, CIFAR10, CIFAR 100, and MNIST in the supplementary material ) to show the robustness of their proposed approach against the state-of-the-art robustness methods under white-box and black-box attacks. The authors show that their proposed method provides: 1) higher accuracy on attacked data (more robustness), and 2) higher accuracy on clean data, closing the gap between the performance on clean and attacked data. In addition, the paper provides insightful experiments on robustness to unforeseen adversaries, robustness to unforeseen corruptions, transfer learning, and ablation studies.