Understanding the robustness-accuracy tradeoff by rethinking robust fairness 

1 INTRODUCTION . 1.1 BACKGROUND . Deep neural networks ( DNNs ) have been proven to be vulnerable to the adversarial attacks , as demonstrated in ( Szegedy ; Goodfellow et al . ; Kurakin et al . ; Carlini & Wagner ) . By adding crafted imperceptible perturbations to the input , attackers can easily fool the model to give an incorrect prediction . To defend against adversarial attacks , tens of methods have been proposed , but most of them later proved to be ineffective ( Athalye et al. , 2018 ) . Among these many defense techniques , adversarial training ( AT ) ( Madry et al. , 2017 ) has been proven to be the most effective strategy against adversarial attacks . Although current AT algorithms can effectively improve model robustness , there are two confusing phenomena in AT models . First , there can be an inevitable robustness-accuracy tradeoff ( Tsipras et al. , 2018 ) in AT models in which increasing robustness is always accompanied by an accuracy drop . Second , recently Xu et al . ( 2021 ) found that AT tends to introduce severe disparities in accuracy and robustness between different classes . For example , as shown in Figure 1b , in a PGD-AT model ( Madry et al. , 2017 ) , both the accuracy and robustness of the 3rd class cat are much lower than those of the 1st class car , while the two classes have similar accuracies in the standard training model ( see Figure 1a ) . This phenomenon is defined as the robust fairness according to the authors . Additionally , as Xu et al . ( 2021 ) mentioned , the robust fairness problem is closely related to the robustness-accuracy tradeoff , because the average accuracy drop in the robustness-accuracy tradeoff could mainly come from the classes that are hard to classify in AT . To verify this , we have measured the accuracy drop for each class , and calculated their percentage in the total accuracy drop , as shown in Figure 1c . We can see that it only takes two classes ( the cat and bird ) to contribute almost half of the accuracy drop , while the two classes have the lowest accuracy and robustness than other classes in AT . That is , these hard classified classes have a significantly greater impact on the decline in accuracy , and to better understand the robustness-accuracy tradeoff , it should be determined why these classes are so difficult to classify in AT . To explain the phenomenon , Xu et al . ( 2021 ) argued that some classes are difficult to classify in AT because they are intrinsically “ harder ” to classify than other classes , and AT tends to hurt both accuracy and robustness of these “ hard ” classes . To verify this point of view , these authors studied the effect of AT on a binary classification task under a mixture Gaussian distribution , and the “ hard ” class is the one with larger variance in their case . They showed that AT will push the decision boundary closer to the larger variance class and further worsen both the accuracy and robustness of the class . However , although they showed that the class with a larger variance is more difficult to classify , there still remains a question ; that is , is variance enough to describe the “ hard ” degree of a class ? Imagine two Gaussian distributions both have a high variance , but also an extremely large difference of mean values , they should still be well classified . On the contrary , when the two Gaussian distributions both have a low variance , but the mean values of them are extremely similar , which makes the two distributions severely overlap , we can not satisfactorily classify them instead . That is , the inter-class similarity is also an important factor affecting the model ’ s accuracy . With this point in mind , we have measured both inter-class similarity and intra-class variance in standard training , PGD-AT and TRADES models ( Zhang et al. , 2019 ) for each class in the CIFAR10 test set , as shown in Figure 2 . The measurement is performed in the penultimate layer feature space . For each class , we use the variance of features as the class ’ s intra-class variance . To measure the inter-class similarity of each class , we first calculate the feature mean value vectors for all classes , and then the cosine similarity between the mean value vectors of the measured class and other classes . The largest cosine similarity is used as the inter-class similarity of the measured class in this paper . It is somewhat surprising to see that both PGD-AT and TRADES models have a lower variance than the standard training model in Figure 2b , while they have a worse accuracy instead . However , as shown in Figure 2a , both PGD-AT and TRADES can lead to a higher inter-class similarity than standard training . In particular , we notice that the “ hardest ” class cat does not have the largest variance no matter in PGD-AT , TRADES or the standard training model , but has the largest inter-class similarity . These observations have challenged Xu et al . ( 2021 ) ’ s theory that the “ hard ” classes are the large variance classes and indicate that inter-class similarity does matter in AT , thus motivated us to study both robust fairness phenomenon and robustness-accuracy tradeoff toward the increased inter-class similarity . 1.2 OUR CONTRIBUTIONS . Understand the robustness-accuracy tradeoff & robust fairness . To the best of our knowledge , we are the first to study the relationship between the robustness-accuracy tradeoff and the robust fairness , and we find that the two phenomena could both come from the increased inter-class similarity caused by AT . More specifically , through our single AT and binary classification AT experiments in section 2 , we find that : • AT will cause a general increase in inter-class similarity for each class , which even causes a feature overlap , and finally leads to the accuracy drop in the tradeoff . • The “ hard ” classes in AT are actually similar classes in standard training , and the increased inter-class similarity in AT makes them more similar and harder to be classified , which causes the robust fairness problem . Re-investigate the effect of smoothing regularizer in AT . Label smoothing ( LS ) ( Szegedy et al. , 2016 ) has been used as a trick to benchmark the robustness in AT by Pang et al . ( 2020 ) , however , we noticed that LS can not only help improve the robustness , but usually improve the accuracy too , which means a reduction in the robustness-accuracy tradeoff . In this paper , we find LS can help alleviate the tradeoff because it helps reduce the large inter-class similarity in AT , and also provides a lower intra-class variance . Then , we investigate the effect of the maximum entropy ( ME ) Pereyra et al . ( 2017 ) , which is also a classic smoothing regularizer , and we find ME can help reduce both inter-class similarity and intra-class variance too . In addition , we find that the state-of-the-art AT method TRADES can be seen as a special maximum entropy learning , which could explain why TRADES model have a lower intra-class variance than PGD-AT model in Figure 2 , and usually performs better than PGD-AT in terms of robustness . We proposed the maximum entropy PGD-AT ( ME-AT ) and the maximum entropy TRADES ( ME-TRADES ) , and experimental results show that our methods can significantly mitigate both tradeoff and robust fairness . 2 RETHINKING ROBUST FAIRNESS TOWARD INTER-CLASS SIMILARITY . In Figure 2a , we have shown that AT models have higher inter-class similarity than the standard training model . In this section , we design two experiments to see how the high inter-class similarity in AT is related to both the robustness-accuracy tradeoff and robust fairness phenomena . 2.1 SINGLE ADVERSARIAL TRAINING . AT causes a feature overlap . We design the single adversarial training ( single AT ) to see how AT affect one single class . In single AT , we only conduct adversarial training on one class while training other classes normally . For better visualization , we adjust the penultimate layer of a ResNet-18 model to output 2-D features . In Figure 3 , we show the single AT results of the two most representative classes : the “ hardest ” class cat and the “ easiest ” class car . The results of other classes and detailed settings are both provided in Appendix A.1 . In Figure 3b , when single adversarial train the 3rd class cat , the features of the cat severely overlap with those of the 5th class dog , and the overlapping features make the class cat almost impossible to classify ( only has 7.03 natural accuracy and 0 PGD-10 robustness ) . This observation intuitively shows how the inter-class similarity increases in AT , and proves that the accuracy drop part in the robustness-accuracy tradeoff could come from the increased inter-class similarity ( the overlapping features ) . The increase in inter-class similarity is general in AT . However , when single AT is carried out for the 1st class car , the features of the class car can still be split well from other classes , and both the accuracy and PGD-10 robustness of the class car achieve a high level ( 98.4 and 72.2 respectively , see Figure 3a ) . Does this mean that the “ easy ” classes can avoid an increase in inter-class similarity in AT ? To check this , we measure the inter-class similarity in the single AT models , and for comparison , we also measured the inter-class similarity of a standard training 2-D features ResNet-18 model . As shown in Figure 4 , each class in the blue line represents the inter-class similarity of the class in the corresponding single AT model ( e.g. , the point of the class car in the blue line represents the interclass similarity of the class car in the single car AT model ) , and the yellow line is the inter-class similarity of the standard training model . We can see that even the “ easiest ” class car in the single AT model can have a higher inter-class similarity than that in the standard training model . This observation turns out that the increase in inter-class similarity is general in AT for all classes . 2.2 BINARY CLASSIFICATION ADVERSARIAL TRAINING . “ Hard ” classes or similar classes ? Since the increase in inter-class similarity is general for all classes , we assume that some classes are difficult to classify in AT possibly because they are already similar in standard training , and the increased inter-class similarity caused by AT makes them more similar and become the “ hard ” classes . To verify this assumption , we conduct the binary classification AT experiments . We set the class cat to binary classify with other classes in CIFAR10 dataset , and we use both PGD-AT ( Madry et al. , 2017 ) and TRADES ( Zhang et al. , 2019 ) to train our binary classification ResNet-18 models ( 512-D features here ) . We plot the natural error and PGD-10 error of the PGD-AT and TRADES trained binary classification models in Figure 5a and Figure 5b respectively . Classes in the horizontal axis represent the classes that binary classified with the class cat , and is sorted from small to large by their similarity with the cat in standard training . We find that both natural error and PGD-10 error in the binary classification PGD-AT and TRADES models are highly positive correlated with the similarity in standard training . For example , the class car is the least similar class of the cat in standard training , when binary classified cat with the car , model can get both low natural error and PGD-10 error ( 4.6 and 11.0 ) ; However , when binary classified cat with the most similar class dog , the ResNet-18 model even failed to converge in PGD-AT ( 49.7 for both natural and PGD-10 error ) , and even model can converge in TRADES , it is also in both highest natural error and PGD-10 error ( 23.4 and 44.0 ) . This observation indicates that the “ hard ” classes in AT could actually be the similar classes in standard training .

Summary: This paper investigates inter-class similarity and intra-class variance, and corroborates that AT will cause an increase in inter-class similarity, which could be the root of both the robustness-accuracy tradeoff and robust fairness phenomena. The authors first considers Label Smoothing (LS) as the regularizer, and concludes that LS will cause a loss of information in the logits, and hence weaken the discriminative power of the trained models. The authors then confirms that ME can help reduce the excessive inter-class similarity in robust models, and also provides a lower intra-class variance, which is the remedy of previous AT methods. Experiments partially support the conclusions of the paper.