Towards A Unified Min-Max Framework for Adversarial Exploration and Robustness

1 INTRODUCTION . Training a machine learning model that is capable of assuring its worst-case performance against all possible adversaries given a specified threat model is a fundamental yet challenging problem , especially for deep neural networks ( DNNs ) ( Szegedy et al. , 2013 ; Goodfellow et al. , 2015 ; Carlini & Wagner , 2017 ) . A common practice to train an adversarially robust model is based on a specific form of min-max training , known as adversarial training ( AT ) ( Goodfellow et al. , 2015 ; Madry et al. , 2017 ) , where the minimization step learns model weights under the adversarial loss constructed at the maximization step in an alternative training fashion . On datasets such as MNIST and CIFAR-10 , AT has achieved the state-of-the-art defense performance against ` p-norm-ball input perturbations ( Athalye et al. , 2018b ) . Motivated by the success of AT , one follow-up question that naturally arises is : Beyond AT , can other types of min-max formulation and optimization techniques advance the research in adversarial robustness ? In this paper , we give an affirmative answer corroborated by the substantial performance gain and the ability of self-learned risk interpretation using our proposed min-max framework on several tasks for adversarial attack and defense . We demonstrate the utility of a general formulation for min-max optimization minimizing the maximal loss induced from a set of risk sources ( domains ) . Our considered min-max formulation is fundamentally different from AT , as our maximization step is taken over the probability simplex of the set of domains . Moreover , we show that many problem setups in adversarial attacks and defenses can in fact be reformulated under this general min-max framework , including attacking model ensembles ( Tramèr et al. , 2018 ; Liu et al. , 2018 ) , devising universal perturbation to input samples ( Moosavi-Dezfooli et al. , 2017 ) or data transformations ( Athalye & Sutskever , 2018 ; Brown et al. , 2017 ) , and generalized AT over multiple types of threat models ( Tramèr & Boneh , 2019 ; Araujo et al. , 2019 ) . However , current methods for solving these tasks often rely on simple heuristics ( e.g. , 1For reproducibility , the code and trained models will be released accompanying this paper . uniform averaging ) , resulting in significant performance drops when comparing to our proposed min-max optimization framework . Specifically , based on the general min-max framework , we show that these problems can be solved under the same optimization procedure and prove the rate of its algorithmic convergence . As a byproduct and an exclusive feature , by tracking the weighting factor associated with the probability simplex during training , our method can provide tools for self-adjusted risk assessment and obtain novel insights on the set of domains for the associated tasks . Contributions ( 1 ) We indicate the utility of min-max optimization beyond AT by proposing a general and theoretically grounded framework on adversarial attack and defense . ( 2 ) We demonstrate the effectiveness of our min-max framework by evaluating the proposed APGD attack on MNIST and CIFAR-10 . In theory , we show that APGD has an O ( 1/T ) convergence rate , where T is the number of iterations . In practice , we show that APGD obtains 17.48 % , 35.21 % and 9.39 % improvement on average compared with PGD attack on CIFAR-10 . ( 3 ) We propose a generalized AT scheme under mixed types of adversarial attacks and demonstrate that the diversified attack ensemble helps adversarial robustness . Compared with vanilla AT , our new training scheme leads to better worst-case robustness even if the defender lacks prior knowledge of the strengths of attacks . ( 4 ) We show how the weighting factors of the probability simplex help to obtain novel insights for associated tasks and interpreting the importance of candidates in domains . Related Work Recent studies have identified that DNNs are highly vulnerable to adversarial manipulations in various applications ( Szegedy et al. , 2013 ; Carlini et al. , 2016 ; Jia & Liang , 2017 ; Lin et al. , 2017 ; Huang et al. , 2017 ; Carlini & Wagner , 2018 ; Zhao et al. , 2018 ; Eykholt et al. , 2018 ; Chen et al. , 2018a ; Lei et al. , 2019 ) , thus leading to an arms race between adversarial attacks ( Carlini & Wagner , 2017 ; Athalye et al. , 2018b ; Goodfellow et al. , 2014 ; Papernot et al. , 2016a ; Moosavi Dezfooli et al. , 2016 ; Chen et al. , 2018b ; Xu et al. , 2019 ) and defenses ( Madry et al. , 2017 ; Papernot et al. , 2016b ; Meng & Chen , 2017 ; Xie et al. , 2017 ; Xu et al. , 2018 ) . One intriguing property of adversarial examples is the transferability across multiple domains ( Liu et al. , 2017 ; Tramèr et al. , 2017 ; Papernot et al. , 2017 ; Su et al. , 2018 ) , which indicates a more challenging yet promising research direction – devising universal adversarial perturbations over model ensembles ( Tramèr et al. , 2018 ; Liu et al. , 2018 ) , input samples ( Moosavi-Dezfooli et al. , 2017 ; Metzen et al. , 2017 ; Shafahi et al. , 2018 ) and data transformations ( Athalye et al. , 2018b ; Athalye & Sutskever , 2018 ; Brown et al. , 2017 ) . However , current approaches suffer from a significant performance loss for resting on the uniform averaging strategy . We will compare these works with our min-max method in Sec . 4 . As a natural extension following min-max attack , we study the generalized AT under multiple perturbations ( Tramèr & Boneh , 2019 ; Araujo et al. , 2019 ; Kang et al. , 2019 ; Croce & Hein , 2019 ) . Finally , our min-max framework is adapted and inspired by previous literature on robust learning over multiple domains ( Qian et al. , 2018 ; Rafique et al. , 2018 ; Lu et al. , 2018 ; 2019a ) . 2 MIN-MAX POWER IN ADVERSARIAL EXPLORATION AND ROBUSTNESS . We begin by introducing the principle of robust learning over multiple domains and its connection to a specialized form of min-max optimization . We then show that the resulting min-max formulation fits into various attack settings for adversarial exploration : a ) ensemble adversarial attack , b ) universal adversarial perturbation and c ) robust perturbation over data transformations . Finally , we propose a generalized adversarial training ( AT ) framework under mixed types of adversarial attacks to improve model robustness . 2.1 GENERAL IDEA : ROBUST LEARNING OVER MULTIPLE DOMAINS . Consider K loss functions { Fi ( v ) } ( each of which is defined on a learning domain ) , the problem of robust learning over K domains can be formulated as ( Qian et al. , 2018 ; Rafique et al. , 2018 ; Lu et al. , 2018 ) minimize v∈V maximize w∈P ∑K i=1 wiFi ( v ) , ( 1 ) where v and w are optimization variables , V is a constraint set , and P denotes the probability simplex P = { w |1Tw = 1 , wi ∈ [ 0 , 1 ] , ∀i } . Since the inner maximization problem in ( 1 ) is a linear function of w over the probabilistic simplex , problem ( 1 ) is thus equivalent to minimize v∈V maximize i∈ [ K ] Fi ( v ) , ( 2 ) where [ K ] denotes the integer set { 1 , 2 , . . . , K } . Benefit and computation challenge of ( 1 ) Compared to multi-task learning in a finite-sum formulation which minimizes K losses on average , problem ( 1 ) provides consistently robust worst-case performance across all domains . This can be explained from the epigraph form of ( 2 ) , minimize v∈V , t t , subject to Fi ( v ) ≤ t , i ∈ [ K ] , ( 3 ) where t is an epigraph variable ( Boyd & Vandenberghe , 2004 ) that provides the t-level robustness at each domain . Although the min-max problem ( 1 ) offers a great robustness interpretation as in ( 3 ) , solving it becomes more challenging than solving the finite-sum problem . It is clear from ( 2 ) that the inner maximization problem of ( 1 ) always returns the one-hot value of w , namely , w = ei , where ei is the ith standard basis vector , and i = arg maxi { Fi ( v ) } . The one-hot coding reduces the generalizability to other domains and induces instability of the learning procedure in practice . Such an issue is often mitigated by introducing a strongly concave regularizer in the inner maximization step ( Lu et al. , 2018 ; Qian et al. , 2018 ) . Regularized problem formulation Spurred by ( Qian et al. , 2018 ) , we penalize the distance between the worst-case loss and the average loss over K domains . This yields minimize v∈V maximize w∈P ∑K i=1 wiFi ( v ) − γ 2 ‖w − 1/K‖ 2 2 , ( 4 ) where γ > 0 is a regularization parameter . As γ → 0 , problem ( 4 ) is equivalent to ( 1 ) . By contrast , it becomes the finite-sum problem when γ → ∞ since w → 1/K . In this sense , the trainable w provides an essential indicator on the importance level of each domain . The larger the weight is , the more important the domain is . We call w domain weights in this paper . We next show how the principle of robust learning over multiple domains can fit into various settings of adversarial attack and defense problems . 2.2 ROBUST ADVERSARIAL ATTACKS . The general goal of adversarial attack is to craft an adversarial example x′ = x0 + δ ∈ Rd to mislead the prediction of machine learning ( ML ) or deep learning ( DL ) systems , where x0 denotes the natural example with the true label t0 , and δ is known as adversarial perturbation , commonly subject to ` p-norm ( p ∈ { 0 , 1 , 2 , ∞ } ) constraint X : = { δ | ‖δ‖p ≤ , x0 + δ ∈ [ 0 , 1 ] d } for a given small number . Here the ` p norm enforces the similarity between x′ and x0 , and the input space of ML/DL systems is normalized to [ 0 , 1 ] d. Ensemble attack over multiple models Consider K ML/DL models { Mi } Ki=1 , the goal is to find robust adversarial examples that can fool all K models simultaneously . In this case , the notion of ‘ domain ’ in ( 4 ) is specified as ‘ model ’ , and the objective function Fi in ( 4 ) signifies the attack loss f ( δ ; x0 , y0 , Mi ) given the natural input ( x0 , y0 ) and the modelMi . Thus , problem ( 4 ) becomes minimize δ∈X maximize w∈P ∑K i=1 wif ( δ ; x0 , y0 , Mi ) − γ 2 ‖w − 1/K‖ 2 2 , ( 5 ) where w encodes the difficulty level of attacking each model . Universal perturbation over multiple examples Consider K natural examples { ( xi , yi ) } Ki=1 and a single modelM , our goal is to find the universal perturbation δ so that all the corruptedK examples can foolM . In this case , the notion of ‘ domain ’ in ( 4 ) is specified as ‘ example ’ , and problem ( 4 ) becomes minimize δ∈X maximize w∈P ∑K i=1 wif ( δ ; xi , yi , M ) − γ 2 ‖w − 1/K‖ 2 2 , ( 6 ) where different from ( 5 ) , w encodes the difficulty level of attacking each example . Adversarial attack over data transformations Consider K categories of data transformation { pi } , e.g. , rotation , lightening , and translation ( Athalye et al. , 2018a ) , our goal is to find the adversarial attack that is robust to data transformations . In this case , the notion of ‘ domain ’ in ( 4 ) is specified as ‘ data transformer ’ , and problem ( 4 ) becomes minimize δ∈X maximize w∈P ∑K i=1 wiEt∼pi [ f ( t ( x0 + δ ) ; y0 , M ) ] − γ 2 ‖w − 1/K‖ 2 2 , ( 7 ) where Et∼pi [ f ( t ( x0+δ ) ; y0 , M ) ] denotes the attack loss under the distribution of data transformation pi , and w encodes the difficulty level of attacking each type of transformed example x0 .

Summary: The paper studies how a min-max framework can incorporate different tasks related to adversarial robustness. Specifically, the authors study adversarial attacks against model ensembles, universal perturbations, and attacks constrained by the union of Lp norms. They propose optimizing a probability distribution over "domains" (models in an ensemble, inputs, Lp balls; respectively per task) and regularizing it to be close to uniform. They perform experiments to evaluate their method.