Improving Model Robustness with Latent Distribution Locally and Globally

1 INTRODUCTION . Deep Neural Networks ( DNNs ) have achieved impressive performance on a broad range of datasets , yet can be easily fooled by adversarial examples or perturbations ( LeCun et al. , 2015 ; He et al. , 2016 ; Gers et al. , 1999 ) . Adversarial examples have been shown to be ubiquitous beyond different tasks such as image classification ( Goodfellow et al. , 2014 ) , segmentation ( Fischer et al. , 2017 ) , and speech recognition ( Carlini & Wagner , 2018 ) . Overall , adversarial examples raise great concerns about the robustness of learning models , and have drawn enormous attention over recent years . To defend adversarial examples , great efforts have been made to improve the model robustness ( Kannan et al. , 2018 ; You et al. , 2019 ; Wang & Zhang , 2019 ; Zhang & Wang , 2019 ) . Most of them are based on the adversarial training , i.e . training the model with adversarially-perturbed samples rather than clean data ( Goodfellow et al. , 2014 ; Madry et al. , 2017 ; Lyu et al. , 2015 ) . In principle , adversarial training is a min-max game between the adversarial perturbations and classifier . Namely , the indistinguishable adversarial perturbations are designed to mislead the output of the classifier , while the classifier is trained to produce the accurate predictions for these perturbed input data . Currently , the adversarial perturbations are mainly computed by enforcing the output invariance in a supervised manner ( Madry et al. , 2017 ) . Despite its effectiveness in some scenarios , it is observed recently that these approaches may still be limited in defending adversarial examples . In particular , we argue that these current adversarial training approaches are typically conducted in a local and supervised way and fail to consider globally the overall data manifold information ; such information however proves crucially important for attaining better generalization . As a result , the generated adversarial examples may corrupt the underlying data structure and would be typically biased towards the decision boundary . Therefore , the well-generalizing features inherent to the data distribution might be lost , which limits the performance of the DNNs to defend adversarial examples even if adversarial training is applied ( Ilyas et al. , 2019a ; Schmidt et al. , 2018 ) . For illustration , we have shown a toy example in Figure 1 . As clearly observed , adversarially-perturbed examples gen- erated by PGD , one of the most successful adversarial training method , corrupt the data manifold , which would inevitably lead to poor performance if the training is conducted based on these perturbed examples . On the other hand , the current state-of-the-art method Feature Scattering ( Zhang & Wang , 2019 ) can partially alleviate this problem but still leads to corruptions on the data manifold . To address this limitation , we propose a novel method called Adversarial Training with Latent Distribution ( ATLD ) which additionally considers the data distribution globally in an unsupervised fashion . In this way , the data manifold could be well preserved , which is beneficial to attain better model generalization . Moreover , since the label information is not required when computing the adversarial perturbations , the resulting adversarial examples would not be biased towards the decision boundary . This can be clearly observed in Figure 1 ( d ) . Our method can be divided into two steps : first , we train the deep model with the adversarial examples which maximize the variance between latent distributions of clean data and adversarial counterpart rather than maximizing the loss function . We reformulate it as a minimax game between a discriminator and a classifier . The adversarial examples are crafted by the discriminator to make different implicitly the latent distributions of clean and perturbed data , while the classifier is trained to decrease the discrepancy between these two latent distributions as well as promoting accurate classification on the adversarial examples as Figure 2 shows . Then , during the inference procedure , we generate the specific perturbations through the discriminator network to diminish the impact of the adversarial attack as shown in Figure 6 in Appendix . On the empirical front , with the toy examples , we show that our proposed method can preserve more information of the original distribution and learn a better decision boundary than the existing adversarial training method . We also test our method on three different datasets : CIFAR-10 , CIFAR100 and SVHN with the famous PGD , CW and FGSM attacks . Our ATLD method outperforms the state-of-the-art methods by a large margin . e.g . ATLD improves over Feature Scattering ( Zhang & Wang , 2019 ) by 17.0 % and 18.1 % on SVHN for PGD20 and CW20 attacks . Our method also shows a large superiority to the conventional adversarial training method ( Madry et al. , 2017 ) , boosting the performance by 32.0 % and 30.7 % on SVHN for PGD20 and CW20 attacks . 2 RELATED WORK . Adversarial Training . Adversarial training is a family of techniques to improve the model robustness ( Madry et al. , 2017 ; Lyu et al. , 2015 ) . It trains the DNNs with adversarially-perturbed samples instead of clean data . Some approaches extend the conventional adversarial training by injecting the adversarial noise to hidden layers to boost the robustness of latent space ( Ilyas et al. , 2019b ; You et al. , 2019 ; Santurkar et al. , 2019 ; Liu et al. , 2019 ) . All of these approaches generate the adversarial examples by maximizing the loss function with the label information . However , the structure of the data distribution is destroyed since the perturbed samples could be highly biased towards the non-optimal decision boundary ( Zhang & Wang , 2019 ) . Our proposed method has a similar training scheme with adversarial training by replacing clean data with the perturbed one . Nevertheless , our method generates the adversarial perturbations without the label information which weakens the impact of non-optimal decision boundary and can retain more information of the underlying data distribution . Manifold-based Adversarial Training . Song et al . ( 2017 ) propose to generate the adversarial examples by projecting on a proper manifold . Zhang & Wang ( 2019 ) leverage the manifold information in the forms of inter-sample relationship within the batch to generate adversarial adversarial perturbations . Virtual Adversarial Training and Manifold Adversarial Training are proposed improve model generalization and robustness against adversarial examples by ensuring the local smoothness of the data distribution ( Zhang et al. , 2018 ; Miyato et al. , 2017 ) . Some methods are designed to enforce the local smoothness around the natural examples by penalizing the difference between the outputs of adversarial examples and clean counterparts ( Kannan et al. , 2018 ; Chan et al. , 2020 ; Jakubovitz & Giryes , 2018 ) . All of these methods just leverage the local information of the distribution or manifold . Differently , our method generates the perturbations additionally considering the structure of distribution globally . Unsupervised Domain Adversarial Training . Domain Adversarial Training shares a training scheme similar to our method where the classifier and discriminator compete with each other ( Odena et al. , 2017 ; Long et al. , 2018 ; Ganin et al. , 2016 ) . However , its objective is to reduce the gap between the source and target distributions in the latent space . The discriminator is used to measure the divergence between these two distributions in the latent space . The training scheme of our method is also based on competition between the classifier and discriminator . Different from the previous framework , the discriminator of our method is used to capture the information of distributions of adversarial examples and clean counterparts in the latent space which helps generate the adversarial perturbations . GAN-based Adversarial Training Methods . Several GAN-based methods leverage GANs to learn the clean data distribution and purify the adversarial examples by projecting them on clean data manifold before classification ( Meng & Chen , 2017 ; Metzen et al. , 2017 ) . The framework of GAN can also be used to generate the adversarial examples ( Baluja & Fischer , 2018 ) . The generator produces the adversarial examples to deceive both the discriminator and classifier ; the discriminator and classifier attempt to differentiate the adversaries from clean data and produce the correct labels respectively . Some adversary detector networks are proposed to detect the adversarial examples which can be well aligned with our method ( Gong et al. , 2017 ; Grosse et al. , 2017 ) . In these works , a pretrained network is augmented with a binary detector network . The training of the pretrained network and detector involves generating adversarial examples to maximize their losses . Differently , our method generates the adversarial examples just to minimize the loss of the discriminator and feed them as the training set to the classifier . Such adversarial examples are deemed to induce most different latent representations from the clean counterpart . 3 BACKGROUND . 3.1 ADVERSARIAL TRAINING . Let us first introduce the widely-adopted adversarial training method for defending against adversarial attacks . Specifically , it solves the following minimax optimization problem through training . min θ { E ( x , y ) ∼D [ max x′∈Sx L ( x′ , y ; θ ) ] } , ( 1 ) where x ∈ Rn and y ∈ R are respectively the clean data samples and the corresponding labels drawn from the dataset D , and L ( · ) is the loss function of the DNN with the model parameter θ ∈ Rm . Furthermore , we denote the clean data distribution as Q0 , i.e . x ∼ Q0 . , and denote x′ ∈ Rn as perturbed samples in a feasible region Sx , { z : z ∈ B ( x , ) ∩ [ −1.0 , 1.0 ] n } with B ( z , ) , { z : ‖x− z‖∞ ≤ } being the ` ∞-ball at center x with radius . By defining fθ ( · ) as the mapping function from the input layer to the last latent layer , we can also rewrite the loss function of the DNN as l ( fθ ( x ) , y ) where l ( · ) denotes the loss function calculated from the last hidden layer of the DNN , e.g . the cross entropy loss as typically used in DNN . Whilst the outer minimization can be conducted by training to find the optimal model parameters θ , the inner maximization essentially generates the strongest adversarial attacks on a given set of model parameters θ . In general , the solution to the minimax problem can be found by training a network minimizing the loss for worst-case adversarial examples , so as to attain adversarial robustness . Given a set of model parameters θ , the commonly adopted solution to the inner maximization problem can lead to either one-step ( e.g. , FGSM ) or multi-step ( e.g. , PGD ) approach ( Madry et al. , 2017 ) . In particular , for a given single point x , the strongest adversarial example x′ at the t-th iteration can be iteratively obtained by the following updating rule : xt+1 = ΠSx ( x t + α · sgn ( ∇xL ( xt , y ; θ ) ) ) , ( 2 ) where ΠSx ( · ) is a projection operator to project the inputs onto the region Sx , sgn ( · ) is the sign function , and α is the updating step size . For the initialization , x0 can be generated by randomly sampling in B ( x , ) . It appears in ( 1 ) that each perturbed sample x′ is obtained individually by leveraging its loss function L ( x′ , y ; θ ) with its label y . However , without considering the inter-relationship between samples , we may lose the global knowledge of the data manifold structure which proves highly useful for attaining better generalization . This issue has been studied in a recent work ( Zhang & Wang , 2019 ) where a new method named feature scattering made a first step to consider the inter-sample relationship within the batch ; unfortunately this approach did not take the full advantages of the global knowledge of the entire data distribution . In addition , relying on the maximization of the loss function , the adversarially-perturbed data samples may be highly biased towards the decision boundary , which potentially corrupts the structure of the original data distribution , especially when the decision boundary is non-optimal ( see Figure 1 again for the illustration ) .

Summary: The paper analyzes the property of local and global data manifold for adversarial training. In particular, they used a discriminator-classifier model, where the discriminator tries to differentiate between the natural and adversarial space, and the classifier aims to classify between them while maintaining the constraints between local and global distributions. The authors implemented the proposed method on several datasets and achieved good performance. They also compared with several whitebox and blackbox methods and proved superiority.