Efficient Robust Training via Backward Smoothing

1 INTRODUCTION . Deep neural networks are well known to be vulnerable to adversarial examples ( Szegedy et al. , 2013 ) , i.e. , a small perturbation on the original input can lead to misclassification or erroneous prediction . Many defense methods have been developed to mitigate the disturbance of adversarial examples ( Guo et al. , 2018 ; Xie et al. , 2018 ; Song et al. , 2018 ; Ma et al. , 2018 ; Samangouei et al. , 2018 ; Dhillon et al. , 2018 ; Madry et al. , 2018 ; Zhang et al. , 2019 ) , among which robust training methods , such as adversarial training ( Madry et al. , 2018 ) and TRADES ( Zhang et al. , 2019 ) , are currently the most effective strategies . Specifically , adversarial training method ( Madry et al. , 2018 ) trains a model on adversarial examples by solving a min-max optimization problem : min θ 1 n n∑ i=1 max x′i∈B ( xi ) L ( fθ ( x ′ i ) , yi ) , ( 1.1 ) where { ( xi , yi ) } ni=1 is the training dataset , f ( · ) denotes the logits output of the neural network , B ( xi ) : = { x : ‖x− xi‖∞ ≤ } denotes the -perturbation ball , and L is the cross-entropy loss . On the other hand , instead of directly training on adversarial examples , TRADES ( Zhang et al. , 2019 ) further improves model robustness with a trade-off between natural accuracy and robust accuracy , by solving the empirical risk minimization problem with a robust regularization term : min θ 1 n n∑ i=1 [ L ( fθ ( xi ) , yi ) + β max x′i∈B ( xi ) KL ( s ( fθ ( xi ) ) , s ( fθ ( x ′ i ) ) ) ] , ( 1.2 ) where s ( · ) denotes the softmax function , and β > 0 is a regularization parameter . The goal of this robust regularization term ( i.e. , KL divergence term ) is to ensure the outputs are stable within the local neighborhood . Both adversarial training and TRADES achieve good model robustness , as shown on recent model robustness leaderboards1 ( Croce & Hein , 2020b ; Chen & Gu , 2020 ) . 1https : //github.com/fra31/auto-attack and https : //github.com/uclaml/RayS . However , a major drawback lies in that both are highly time-consuming for training , limiting their usefulness in practice . This is largely due to the fact that both methods perform iterative adversarial attacks ( i.e. , Projected Gradient Descent ) to solve the inner maximization problem in each outer minimization step . Recently , Wong et al . ( 2020 ) shows that it is possible to use single-step adversarial attacks to solve the inner maximization problem , which previously was believed impossible . The key ingredient in their approach is adding a random initialization step before the single-step adversarial attack . This simple change leads to a reasonably robust model that outperforms other fast robust training techniques , e.g. , Shafahi et al . ( 2019 ) . However , it remains a mystery why random initialization is empirically effective . Furthermore , compared to state-of-the-art robust training models ( Madry et al. , 2018 ; Zhang et al. , 2019 ) , this approach still lags behind on model robustness . In this work , we aim to understand the role of random initialization , as well as closing the robustness gap between adversarial training and Fast Adversarial Training ( Fast AT ) ( Wong et al. , 2020 ) . We propose a new principle towards understanding Fast AT - that random initialization can be viewed as performing randomized smoothing for better optimization of the inner maximization problem . We demonstrate that the smoothing effect by random initialization is not sufficient under the adversarial perturbation constraint . By proposing a new initialization strategy , backward smoothing , which strengthens the smoothing effect within the -perturbation ball , we present a new fast robust training method based on TRADES ( Zhang et al. , 2019 ) . The resulting method significantly improves both stability and model robustness over the single-step version of TRADES ( Zhang et al. , 2019 ) , while consuming much less training time ( ∼ 3x improvement with the same training schedule ) . 2 RELATED WORK . There exists a large body of work on adversarial attacks and defenses . In this section , we only review the most relevant work to ours . Adversarial Attack The concept of adversarial examples was first proposed in Szegedy et al . ( 2013 ) . Since then , many methods have been proposed , such as Fast Gradient Sign Method ( FGSM ) ( Goodfellow et al. , 2015 ) , and Projected Gradient Descent ( PGD ) ( Kurakin et al. , 2016 ; Madry et al. , 2018 ) . Later on , various attacks ( Papernot et al. , 2016 ; Moosavi-Dezfooli et al. , 2016 ; Carlini & Wagner , 2017 ; Athalye et al. , 2018 ; Chen et al. , 2020 ; Croce & Hein , 2020a ) were also proposed for better effectiveness or efficiency . There are also many attacks focused on different attack settings . Chen et al . ( 2017 ) proposed a black-box attack where the gradient is not available , by estimating the gradient via finite-differences . Various methods ( Ilyas et al. , 2018 ; Al-Dujaili & O ’ Reilly , 2020 ; Moon et al. , 2019 ; Andriushchenko et al. , 2019 ; Tashiro et al. , 2020 ) have been developed to improve the query efficiency of Chen et al . ( 2017 ) . Other methods ( Brendel et al. , 2018 ; Cheng et al. , 2019 ; 2020 ) focused on the more challenging hard-label attack setting , where only the prediction labels are available . On the other hand , there is recent work ( Croce & Hein , 2020b ; Chen & Gu , 2020 ) that aims to accurately evaluate the model robustness via ensemble of attacks or effective hard-label attack . Robust Training Many heuristic defenses ( Guo et al. , 2018 ; Xie et al. , 2018 ; Song et al. , 2018 ; Ma et al. , 2018 ; Samangouei et al. , 2018 ; Dhillon et al. , 2018 ) were proposed when the concept of adversarial examples was first introduced . However , they are later shown by Athalye et al . ( 2018 ) as not truly robust . Adversarial training ( Madry et al. , 2018 ) is the first effective method towards defending against adversarial examples . In Wang et al . ( 2019 ) , a new convergence quality criterion was proposed . Zhang et al . ( 2019 ) showed the trade-off between natural accuracy and robust accuracy . Wang et al . ( 2020 ) proposed to improve model robustness by better utilizing misclassified examples . Another line of research utilizes extra information ( e.g. , pre-trained models ( Hendrycks et al. , 2019 ) or extra unlabeled data ( Carmon et al. , 2019 ; Alayrac et al. , 2019 ) ) to further improve robustness . Other work focuses on improving training efficiency , such as free adversarial training from Shafahi et al . ( 2019 ) and Fast AT from Wong et al . ( 2020 ) using single-step attack ( FGSM ) with random initialization . Li et al . ( 2020 ) proposed a hybrid approach for improving Fast AT which is orthogonal to ours . Andriushchenko & Flammarion ( 2020 ) proposed a new regularizer promoting gradient alignment . Yet , it is not focused on closing the robustness gap with state-of-the-arts . Randomized Smoothing Duchi et al . ( 2012 ) proposed the randomized smoothing technique and proved variance-based convergence rates for non-smooth optimization . Later on , this technique was applied to certified adversarial defenses ( Cohen et al. , 2019 ; Salman et al. , 2019 ) for building robust models with certified robustness guarantees . In this paper , we are not targeting certified defenses . Instead , we use the randomized smoothing concept in optimization to explain Fast AT . 3 WHY RANDOM INITIALIZATION HELPS ? . We aim to explain why random initialization in Fast AT is effective , and propose a new understanding that random initialization can be viewed as performing randomized smoothing on the inner maximization problem in adversarial training ( Madry et al. , 2018 ) . Below , we first introduce the randomized smoothing technique ( Duchi et al. , 2012 ) in optimization . It is well known from optimization theory ( Boyd et al. , 2004 ) that non-smooth objectives are generally harder to optimize compared with smooth objectives . In general , a smoother loss function allows us to use a larger step size while guaranteeing the convergence of gradient-based algorithms . Randomized smoothing technique ( Duchi et al. , 2012 ) was proposed based on the observation that random perturbation of the optimization variable can be used to transform the loss into a smoother one . Instead of using only the gradient at the original iterate , randomized smoothing proposes to randomly generate perturbed iterates and use their gradients for optimization procedure . More details are provided in Appendix A . Let us recall the inner maximization problem in adversarial training : max δ∈B ( 0 ) L ( fθ ( x+ δ ) , y ) . ( 3.1 ) Here , fθ denotes a neural network parameterized by θ . In general , neural networks are non-smooth due to ReLU activations and pooling layers . This suggests that ( 3.1 ) can be difficult to solve , and using gradient descent with large step size can lead to divergence in the maximization problem . It also explains why directly using single-step projected gradient ascent without random initialization fails ( Wong et al. , 2020 ) . Now , let us apply randomized smoothing to ( 3.1 ) : max δ∈B ( 0 ) Eξ∼U ( −1,1 ) L ( fθ ( x+ δ + ξ ) , y ) , ( 3.2 ) where ξ is the perturbation vector for randomized smoothing , and δ is the perturbation vector for later gradient update step ( initialized as zero ) . Suppose we solve ( 3.2 ) in a stochastic fashion ( i.e. , sample a random perturbation ξ instead of computing the expectation over ξ ) , and using only one step gradient update . We can see that this reduces to the Fast AT formulation . This suggests that Fast AT can be viewed as performing stochastic single-step attacks on a randomized smoothed objective function which allows using larger step size . This explains why random initialization helps Fast AT as it makes the loss objective smoother and thus easier to optimize . It is worth noting that Andriushchenko & Flammarion ( 2020 ) also provided an explanation of why Fast Adversarial Training works : random initialization reduces the magnitude of the perturbation and thus the network becomes more linear and fits better toward single-step attack . While we argue that the random initialization works as randomized smoothing for smoothing the inner maximization problem and makes it easier to solve . In fact , our argument is more general and can cover theirs , because if the loss function is approximately linear , then it will be very smooth , i.e. , the second-order term in the Taylor expansion is very small . 4 PROPOSED APPROACH . 4.1 DRAWBACKS OF THE RANDOM INITIALIZATION STRATEGY . Although Fast AT achieves much faster robust training compared with standard adversarial training ( Madry et al. , 2018 ) , it exposes several major weaknesses . For demonstration , we exclude the additional acceleration techniques introduced in Wong et al . ( 2020 ) for accelerating the training speed ( e.g. , mix-precision training , cyclic learning rate ) , and instead apply standard piecewise learning rate decay used in Madry et al . ( 2018 ) ; Zhang et al . ( 2019 ) with the decay point set at the 50-th and 75-th epochs . Performance Stability As observed in Li et al . ( 2020 ) , Fast AT can be highly unstable ( i.e. , large variance in robust performance ) when using traditional piecewise learning rate decay schedule . We argue that this is because Wong et al . ( 2020 ) utilized a drastically large attack step size ( 10/255 , even larger than the perturbation limit ) , which causes unstable training behavior . To validate this , we run Fast AT on CIFAR-10 using ResNet-18 model ( He et al. , 2016 ) for 10 times with different step sizes . Note that we adopt early-stopping and record the best-performing model among 100 epochs . As shown in Figure 1 , although the single-best robustness performance is obtained by using step size 10/255 , the variance is very high . Moreover , most trials lead to weak robust performance with a low average and median robust accuracy . On the other hand , we observe that when using step size 8/255 , model robustness is more stable and higher on average . Note that using a too small step size would by nature hurt model robustness . These observations suggest that Fast AT can not achieve the best performance on robust performance and stability simultaneously . Potential for Robustness Improvement Fast AT uses standard adversarial training ( Madry et al. , 2018 ) as the baseline , and can obtain similar robustness performance . However , later work ( Rice et al. , 2020 ) shows that adversarial training can cause the overfitting problem , while early stopping can largely improve robustness . Zhang et al . ( 2019 ) further achieves even better model robustness that is much higher than what Fast AT obtains . From Table 1 , we observe that there exists an 8 % robust accuracy gap between Fast AT ( average over 10 runs ) and the best-performing TRADES model . Even for the best out of 10 trials , there is still a 6 % gap . This indicates that Fast AT is still far from optimal , and there is still big room for further robustness improvement .

Summary: The paper proposes a new algorithm for performing fast adversarial training. The proposed algorithm consists in solving the inner maximization problem in the following way: first, one takes a step of projected gradient descent (PGD) wrt an auxiliary loss (motivated by the idea of backward smoothing), and then one takes another step of PGD wrt the original loss function which is the KL divergence as suggested by the TRADES paper. The authors argue that taking two steps of PGD wrt different losses leads (perhaps, surprisingly) to higher robustness compared to taking two steps of PGD wrt the same original loss function.