Cost-Sensitive Robustness against Adversarial Examples

1 INTRODUCTION . Despite the exceptional performance of deep neural networks ( DNNs ) on various machine learning tasks such as malware detection ( Saxe & Berlin , 2015 ) , face recognition ( Parkhi et al. , 2015 ) and autonomous driving ( Bojarski et al. , 2016 ) , recent studies ( Szegedy et al. , 2014 ; Goodfellow et al. , 2015 ) have shown that deep learning models are vulnerable to misclassifying inputs , known as adversarial examples , that are crafted with targeted but visually-imperceptible perturbations . While several defense mechanisms have been proposed and empirically demonstrated to be successful against existing particular attacks ( Papernot et al. , 2016 ; Goodfellow et al. , 2015 ) , new attacks ( Carlini & Wagner , 2017 ; Tramèr et al. , 2018 ; Athalye et al. , 2018 ) are repeatedly found that circumvent such defenses . To end this arm race , recent works ( Wong & Kolter , 2018 ; Raghunathan et al. , 2018 ; Wong et al. , 2018 ; Wang et al. , 2018 ) propose methods to certify examples to be robust against some specific norm-bounded adversarial perturbations for given inputs and to train models to optimize for certifiable robustness . However , all of the aforementioned methods aim at improving the overall robustness of the classifier . This means that the methods to improve robustness are designed to prevent seed examples in any class from being misclassified as any other class . Achieving such a goal ( at least for some definitions of adversarial robustness ) requires producing a perfect classifier , and has , unsurprisingly , remained elusive . Indeed , Mahloujifar et al . ( 2019 ) proved that if the metric probability space is concentrated , overall adversarial robustness is unattainable for any classifier with initial constant error . We argue that overall robustness may not be the appropriate criteria for measuring system performance in security-sensitive applications , since only certain kinds of adversarial misclassifications pose meaningful threats that provide value for potential adversaries . Whereas overall robustness places equal emphasis on every adversarial transformation , from a security perspective , only certain transformations matter . As a simple example , misclassifying a malicious program as benign results in more severe consequences than the reverse . In this paper , we propose a general method for adapting provable defenses against norm-bounded perturbations to take into account the potential harm of different adversarial class transformations . Inspired by cost-sensitive learning ( Domingos , 1999 ; Elkan , 2001 ) for non-adversarial contexts , we capture the impact of different adversarial class transformations using a cost matrix C , where each entry represents the cost of an adversary being able to take a natural example from the first class and perturb it so as to be misclassified by the model as the second class . Instead of reducing the overall robust error , our goal is to minimize the cost-weighted robust error ( which we define for both binary and real-valued costs in C ) . The proposed method incorporates the specified cost matrix into the training objective function , which encourages stronger robustness guarantees on cost-sensitive class transformations , while maintaining the overall classification accuracy on the original inputs . Contributions . By encoding the consequences of different adversarial transformations into a cost matrix , we introduce the notion of cost-sensitive robustness ( Section 3.1 ) as a metric to assess the expected performance of a classifier when facing adversarial examples . We propose an objective function for training a cost-sensitive robust classifier ( Section 3.2 ) . The proposed method is general in that it can incorporate any type of cost matrix , including both binary and real-valued . We demonstrate the effectiveness of the proposed cost-sensitive defense model for a variety of cost scenarios on two benchmark image classification datasets : MNIST ( Section 4.1 ) and CIFAR10 ( Section 4.2 ) . Compared with the state-of-the-art overall robust defense model ( Wong & Kolter , 2018 ) , our model achieves significant improvements in cost-sensitive robustness for different tasks , while maintaining approximately the same classification accuracy on both datasets . Notation . We use lower-case boldface letters such as x for vectors and capital boldface letters such as A to represent matrices . Let [ m ] be the index set { 1 , 2 , . . . , m } and Aij be the ( i , j ) -th entry of matrix A. Denote the i-th natural basis vector , the all-ones vector and the identity matrix by ei , 1 and I respectively . For any vector x ∈ Rd , the ` ∞-norm of x is defined as ‖x‖∞ = maxi∈ [ d ] |xi| . 2 BACKGROUND . In this section , we provide a brief introduction on related topics , including neural network classifiers , adversarial examples , defenses with certified robustness , and cost-sensitive learning . 2.1 NEURAL NETWORK CLASSIFIERS . A K-layer neural network classifier can be represented by a function f : X → Y such that f ( x ) = fK−1 ( fK−2 ( · · · ( f1 ( x ) ) ) ) , for any x ∈ X . For k ∈ { 1 , 2 , . . . , K−2 } , the mapping function fk ( · ) typically consists of two operations : an affine transformation ( either matrix multiplication or convolution ) and a nonlinear activation . In this paper , we consider rectified linear unit ( ReLU ) as the activation function . If denote the feature vector of the k-th layer as zk , then fk ( · ) is defined as zk+1 = fk ( zk ) = max { Wkzk + bk,0 } , ∀k ∈ { 1 , 2 , . . .K − 2 } , where Wk denotes the weight parameter matrix and bk the bias vector . The output function fK−1 ( · ) maps the feature vector in the last hidden layer to the output space Y solely through matrix multiplication : zK = fK−1 ( zK−1 ) = WK−1zK−1 + bK−1 , where zK can be regarded as the estimated score vector of input x for different possible output classes . In the following discussions , we use fθ to represent the neural network classifier , where θ = { W1 , . . . , WK−1 , b1 , . . . , bK−1 } denotes the model parameters . To train the neural network , a loss function ∑N i=1 L ( fθ ( xi ) , yi ) is defined for a set of training examples { xi , yi } Ni=1 , where xi is the i-th input vector and yi denotes its class label . Cross-entropy loss is typically used for multiclass image classification . With proper initialization , all model parameters are then updated iteratively using backpropagation . For any input example x̃ , the predicted label ŷ is given by the index of the largest predicted score among all classes , argmaxj [ fθ ( x̃ ) ] j . 2.2 ADVERSARIAL EXAMPLES . An adversarial example is an input , generated by some adversary , which is visually indistinguishable from an example from the natural distribution , but is able to mislead the target classifier . Since “ visually indistinguishable ” depends on human perception , which is hard to define rigorously , we consider the most popular alternative : input examples with perturbations bounded in ` ∞-norm ( Goodfellow et al. , 2015 ) . More formally , the set of adversarial examples with respect to seed example { x0 , y0 } and classifier fθ ( · ) is defined as A ( x0 , y0 ; θ ) = { x ∈ X : ‖x− x0‖∞ ≤ and argmax j [ fθ ( x ) ] j 6= y0 } , ( 2.1 ) where > 0 denotes the maximum perturbation distance . Although ` p distances are commonly used in adversarial examples research , they are not an adequate measure of perceptual similarity ( Sharif et al. , 2018 ) and other minimal geometric transformations can be used to find adversarial examples ( Engstrom et al. , 2017 ; Kanbak et al. , 2018 ; Xiao et al. , 2018 ) . Nevertheless , there is considerable interest in improving robustness in this simple domain , and hope that as this research area matures we will find ways to apply results from studying simplified problems to more realistic ones . 2.3 DEFENSES WITH CERTIFIED ROBUSTNESS . A line of recent work has proposed defenses that are guaranteed to be robust against norm-bounded adversarial perturbations . Hein & Andriushchenko ( 2017 ) proved formal robustness guarantees against ` 2-norm bounded perturbations for two-layer neural networks , and provided a training method based on a surrogate robust bound . Raghunathan et al . ( 2018 ) developed an approach based on semidefinite relaxation for training certified robust classifiers , but was limited to two-layer fullyconnected networks . Our work builds most directly on Wong & Kolter ( 2018 ) , which can be applied to deep ReLU-based networks and achieves the state-of-the-art certified robustness on MNIST dataset . Following the definitions in Wong & Kolter ( 2018 ) , an adversarial polytope Z ( x ) with respect to a given example x is defined as Z ( x ) = { fθ ( x + ∆ ) : ‖∆‖∞ ≤ } , ( 2.2 ) which contains all the possible output vectors for the given classifier fθ by perturbing x within an ` ∞-norm ball with radius . A seed example , { x0 , y0 } , is said to be certified robust with respect to maximum perturbation distance , if the corresponding adversarial example set A ( x0 , y0 ; θ ) is empty . Equivalently , if we solve , for any output class ytarg 6= y0 , the optimization problem , minimize zK [ zK ] y0 − [ zK ] ytarg , subject to zK ∈ Z ( x0 ) , ( 2.3 ) then according to the definition ofA ( x0 , y0 ; θ ) in ( 2.1 ) , { x0 , y0 } is guaranteed to be robust provided that the optimal objective value of ( 2.3 ) is positive for every output class . To train a robust model on a given dataset { xi , yi } Ni=1 , the standard robust optimization aims to minimize the sample loss function on the worst-case locations through the following adversarial loss minimize θ N∑ i=1 max ‖∆‖∞≤ L ( fθ ( xi + ∆ ) , yi ) , ( 2.4 ) where L ( · , · ) denotes the cross-entropy loss . However , due to the nonconvexity of the neural network classifier fθ ( · ) introduced by the nonlinear ReLU activation , both the adversarial polytope ( 2.2 ) and training objective ( 2.4 ) are highly nonconvex . In addition , solving optimization problem ( 2.3 ) for each pair of input example and output class is computationally intractable . Instead of solving the optimization problem directly , Wong & Kolter ( 2018 ) proposed an alternative training objective function based on convex relaxation , which can be efficiently optimized through a dual network . Specifically , they relaxed Z ( x ) into a convex outer adversarial polytope Z̃ ( x ) by replacing the ReLU inequalities for each neuron z = max { ẑ , 0 } with a set of inequalities , z ≥ 0 , z ≥ ẑ , −uẑ + ( u− ` ) z ≤ −u ` , ( 2.5 ) where u , ` denote the lower and upper bounds on the considered pre-ReLU activation.1 Based on the relaxed outer bound Z̃ ( x ) , they propose the following alternative optimization problem , minimize zK [ zK ] y0 − [ zK ] ytarg , subject to zK ∈ Z̃ ( x0 ) , ( 2.6 ) which is in fact a linear program . Since Z ( x ) ⊆ Z̃ ( x ) for any x ∈ X , solving ( 2.6 ) for all output classes provides stronger robustness guarantees compared with ( 2.3 ) , provided all the optimal 1The elementwise activation bounds can be computed efficiently using Algorithm 1 in Wong & Kolter ( 2018 ) . objective values are positive . In addition , they derived a guaranteed lower bound , denoted by J ( x0 , gθ ( ey0 − eytarg ) ) , on the optimal objective value of Equation 2.6 using duality theory , where gθ ( · ) is aK-layer feedforward dual network ( Theorem 1 in Wong & Kolter ( 2018 ) ) . Finally , according to the properties of cross-entropy loss , they minimize the following objective to train the robust model , which serves as an upper bound of the adversarial loss ( 2.4 ) : minimize θ 1 N N∑ i=1 L ( − J ( xi , gθ ( eyi · 1 > − I ) ) , yi ) , ( 2.7 ) where gθ ( · ) is regarded as a columnwise function when applied to a matrix . Although the proposed method in Wong & Kolter ( 2018 ) achieves certified robustness , its computational complexity is quadratic with the network size in the worst case so it only scales to small networks . Recently , Wong et al . ( 2018 ) extended the training procedure to scale to larger networks by using nonlinear random projections . However , if the network size allows for both methods , we observe a small decrease in performance using the training method provided in Wong et al . ( 2018 ) . Therefore , we only use the approximation techniques for the experiments on CIFAR10 ( §4.2 ) , and use the less scalable method for the MNIST experiments ( §4.1 ) .

Summary: The paper introduces a new concept of certified cost-sensitive robustness against adversarial attacks. A cost-sensitive robust optimization formulation is then proposed for deep adversarial learning. Experimental results on two benchmark datasets (MNIST, CIFAR-10) are reported to show the superiority of the proposed method to overall robustness method, both with binary and real-value cost matrices.