Learning to Generate Noise for Multi-Attack Robustness

1 INTRODUCTION . Deep neural networks have demonstrated enormous success on multiple benchmark applications ( Amodei et al. , 2016 ; Devlin et al. , 2018 ) , by achieving super-human performance on certain tasks . However , to deploy them to safety-critical applications ( Shen et al. , 2017 ; Chen et al. , 2015 ; Mao et al. , 2019 ) , we need to ensure that the model is robust as well as accurate , since incorrect predictions may lead to severe consequences . Notably , it is well-known that the existing neural networks are highly susceptible to carefully crafted image perturbations which are imperceptible to humans but derail the predictions of these otherwise accurate networks . The emergence of adversarial examples has received significant attention in the research community , and several defense mechanisms have been proposed ( Madry et al. , 2017 ; Zhang et al. , 2019 ; Carmon et al. , 2019 ) . However , despite a large literature to improve upon the robustness of neural networks , most of the existing defenses leverage the knowledge of the adversaries and are based on the assumption of only a single type of perturbation . Consequently , many of the proposed defenses were circumvented by stronger attacks ( Athalye et al. , 2018 ; Uesato et al. , 2018 ; Tramer et al. , 2020 ) . Meanwhile , several recent works have ( Schott et al. , 2018 ; Tramèr & Boneh , 2019 ) demonstrated the vulnerability of existing defense methods against multiple perturbations . For the desired multi-attack robustness , Tramèr & Boneh ( 2019 ) ; Maini et al . ( 2020 ) proposed various strategies to aggregate multiple perturbations during training . However , training with multiple perturbations comes at an additional cost ; it increases the training cost by a factor of four over adversarial training , which is already an order of magnitude more costly than standard training . This slowdown factor hinders the research progress of robustness against multiple perturbations due to the large computation overhead incurred during training . Some recent works reduce this cost by reducing the complexity of generating adversarial examples ( Shafahi et al. , 2019 ; Wong et al. , 2020 ) , however , they are limited to ` ∞ adversarial training . To address the drawbacks of existing methods , we propose a novel training scheme , Meta Noise Generator with Adversarial Consistency ( MNG-AC ) , which learns instance-dependent noise to minimize the adversarial loss across multiple perturbations while enforcing label consistency between them , as illustrated in Figure 1 and explained in details below . First , we tackle the heavy computational overhead incurred by multi-perturbation training by proposing Stochastic Adversarial Training ( SAT ) , that samples from a distribution of perturbations during training , which significantly accelerates training for multiple perturbations1 . Then , based on the assumption that the model should output the same predictions for different perturbations of the same image , we introduce Adversarial Consistency ( AC ) loss that enforces label consistency across multiple perturbations . Finally , motivated by the noise regularization techniques ( Huang et al. , 2016 ; Srivastava et al. , 2014 ; Noh et al. , 2017 ; Lee et al. , 2020 ) which target generalization , we formulate a Meta Noise Generator ( MNG ) that learns to stochastically perturb a given sample in a meta-learning framework to explicitly improve the generalization and label consistency across multiple attacks . In particular , MNG-AC utilizes our generated samples to enforce label consistency across the generated samples from our model , adversarial samples , and clean samples . Consequently , it pushes the decision boundary ( see Figure 4 ) and enforces a smooth and robust network across multiple perturbations . We validate the efficacy and efficiency of our proposed method by comparing it against existing , state-of-the-art methods on CIFAR-10 , SVHN , and Tiny-ImageNet dataset . The experimental results show that our method obtains significantly superior performance over all the baseline methods trained with multiple perturbations , generalizes to diverse perturbations , and substantially reduces the computational cost incurred by training with multiple perturbations . In summary , the major contributions of this paper are as follows : • We introduce Adversarial Consistency ( AC ) loss that enforces label consistency across multiple perturbations to enforce smooth and robust networks . • We formulate Meta-Noise Generator that explicitly meta-learns an input-dependent noise generator , such that it outputs stochastic noise distribution to improve the model ’ s robustness and adversarial consistency across multiple types of adversarial perturbations . • We validate our proposed method on various datasets against diverse benchmark adversarial attacks , on which it achieves state-of-the-art performance , highlighting its practical impact . 2 RELATED WORK . Robustness against single adversarial perturbation . In the past few years , multiple defenses have been proposed to defend against a single type of attack ( Madry et al. , 2017 ; Xiao et al. , 2020 ; Zhang et al. , 2019 ; Carmon et al. , 2019 ) and have been consequently circumvented by subsequent attacks ( Athalye et al. , 2018 ; Brendel et al. , 2018 ; Tramer et al. , 2020 ) . Adversarial-training based 1By a factor of four on a single machine with four GeForce RTX 2080Ti on CIFAR-10 and SVHN dataset using Wide ResNet 28-10 ( Zagoruyko & Komodakis , 2016 ) architecture . defenses ( Madry et al. , 2017 ; Zhang et al. , 2019 ; Carmon et al. , 2019 ) have been the only exceptions that have withstood the intense scrutiny and have provided empirical gains in adversarial robustness . Generative models for adversarial robustness . There have been various attempts that leverage the representative power of generative models to improve model robustness . Samangouei et al . ( 2018 ) ; Jalal et al . ( 2017 ) project an image onto the generator manifold , which is then classified by the discriminator . Song et al . ( 2018 ) uses the sensitivity of generative models to defend against a single perturbation . Yin et al . ( 2020 ) proposed a detection method based on input space partitioning . However , Samangouei et al . ( 2018 ) ; Jalal et al . ( 2017 ) ; Song et al . ( 2018 ) were shown to be ineffective by stronger attacks ( Carlini & Wagner , 2017 ; Athalye et al. , 2018 ) . In contrast to learning the generative model to model the adversarial examples , we meta-learn the generator to explicitly learn an input-dependent optimal noise distribution to lower adversarial error across multiple perturbations , that does not necessarily correspond to any of the attack perturbations . Robustness against multiple adversarial perturbations . Schott et al . ( 2018 ) demonstrated that ` ∞ adversarial training is highly susceptible to ` 0/ ` 2-norm adversarial perturbations and used multiple VAEs to defend against multiple perturbations on the MNIST dataset . However , it was not scalable and limited to the MNIST dataset . Tramèr & Boneh ( 2019 ) investigated the theoretical/empirical trade-offs between multiple perturbations and introduced adversarial training with worst/average perturbations to defend against multiple perturbations . Maini et al . ( 2020 ) incorporated multiple perturbations into a single adversary to maximize the adversarial loss . However , computing all the perturbations is impractical for multiple perturbations and large scale datasets . On the other hand , our proposed framework overcomes this limitation , with improved performance over these methods and has a negligible increase in training cost over multi-perturbation adversarial training . 3 ROBUSTNESS AGAINST MULTIPLE PERTURBATIONS . We first briefly review single/multi-perturbation adversarial training and introduce Stochastic Adversarial Training ( SAT ) to reduce the computational cost incurred by training with multiple perturbations . We consider a dataset D over observations x ∈ Rd and labels y ∈ RC with C classes . Let fθ : Rd → RC be a L-layered classifier with parameters θ and classification loss Lcls . Given an attack procedure A ( x ) with norm-ball BA ( x , ε ) around x with radius ε for each example , which introduces a perturbation δ , we let xadv = x+ δ denote the corresponding adversarial examples . We consider the ` p norm distance under the additive threat model ( Laidlaw & Feizi , 2019 ) and adopt the projected-gradient descent ( PGD ) ( Madry et al. , 2017 ) for crafting the ` p perturbations : xadv ( t+1 ) = proj BA ( x , ε ) ( xadv ( t ) + argmax ||v||A≤αA vTAOxadv ( t ) Lcls ( fθ ( xadv ( t ) ) , y ) ) , ( 1 ) where xadv0 is chosen at random within BA ( x , ε ) , αA is the step size , proj is the projection operator projecting the input onto the norm ball BA ( x , ε ) , and xadv ( t+1 ) denotes the adversarial example at the t-th PGD step . We will refer the approximation of the maximum loss by an attack procedure A ( x ) , such that maxδ∈BA ( x , ε ) Lcls ( fθ ( x+ δ ) , y ) ≈ Lcls ( fθ ( A ( x ) ) , y ) for the rest of our paper . Single-perturbation adversarial training . In the standard single-perturbation adversarial training ( Kurakin et al. , 2016 ; Madry et al. , 2017 ) , the model optimizes the network using a min-max formulation . More formally , the inner maximization generates the adversarial perturbation by maximizing the loss , while the outer minimization minimizes the loss on the generated examples . min θ E ( x , y ) ∼D Lcls ( fθ ( A ( x ) ) , y ) . ( 2 ) The majority of existing single-perturbation defenses are primarily able to defend against a single category of adversarial perturbation . However , this limits the generalization of these methods to perturbations that are unseen during training ( Schott et al. , 2018 ; Tramèr & Boneh , 2019 ) , which has been referred to as overfitting on the particular type of training perturbation . Multi-perturbation adversarial training . Tramèr & Boneh ( 2019 ) extended the adversarial training to multiple perturbations by optimizing the outer objective in Eq . ( 2 ) on the strongest/union of adversarial perturbations for each input example . Their proposed strategies can more formally be defined as follows : 1 . The maximum over all perturbations : It optimizes the outer objective in Eq . ( 2 ) on the strongest adversarial perturbation from the whole set of additive adversarial perturbations min θ E ( x , y ) ∼D [ argmaxk Lcls ( fθ ( Ak ( x ) ) , y ) ] . ( 3 ) 2 . The average over all perturbations : It optimizes the outer objective in Eq . ( 2 ) on the whole set of n additive perturbations . min θ E ( x , y ) ∼D 1 n k=n∑ k=1 Lcls ( fθ ( Ak ( x ) , y ) ) . ( 4 ) Recently , Maini et al . ( 2020 ) proposed “ Multi Steepest Descent ” ( MSD ) by incorporating the different perturbations into the direction of steepest descent . However , the practicality of all these methods is limited due to an increased computational overhead for training . Stochastic Adversarial Training ( SAT ) . To overcome this limitation , we propose Stochastic Adversarial Training to defend against multiple adversarial perturbations . Specifically , we conjecture that it is essential to cover the threat model during training , not utilizing all the perturbations simultaneously . We formulate the threat model as a random attack A ( x ) sampled uniformly from a perturbation set S during each episode ( or batch ) of training which prevents overfitting on a particular adversarial perturbation . In this work , we consider the ` p-bounded perturbation set , and we sample the attack procedure A ( x ) with its corresponding norm-ball BA ( x , ε ) from the perturbation set S as follows : S = { A1 ( x ) , . . . , An ( x ) } , k ∼ Cat ( ( 1/n , . . . , 1/n ) ) , A ( x ) = Sk ( x ) , ( 5 ) where Cat is the categorical distribution and n is the number of attacks in the perturbation set S. Our proposed SAT optimizes the outer objective in Eq . ( 2 ) using the sampled attack procedure A ( x ) and is a drastic simplification of the average one in Eq . ( 4 ) , which makes it highly efficient for multiple perturbations . It is important to note that unlike the average and max strategy SAT can be applied to any perturbation set with a constant cost and it promotes generalization and convergence ( due to its stochasticity ) by preventing over-fitting on a single type of perturbation .

Summary: The authors propose a new method to improve robustness to adversarial examples under various norms (L1, L2 and LInf). Their method combines adversarial training with an adversarial noise generator. They improve upon adversarial training in a multi norm setting by choosing one norm at random for each sample, instead of computing an adversarial for all norms, thus significantly reducing the training time. They additionally improve robustness by regularizing model features between the standard image, the adversarially perturbed image and a perturbation of the image created with an adversarial noise generator.