Improving the Generalization of Adversarial Training with Domain Adaptation

1 INTRODUCTION . Deep learning techniques have shown impressive performance on image classification and many other computer vision tasks . However , recent works have revealed that deep learning models are often vulnerable to adversarial examples ( Szegedy et al. , 2014 ; Goodfellow et al . ; Papernot et al. , 2016 ) , which are maliciously designed to deceive the target model by generating carefully crafted adversarial perturbations on original clean inputs . Moreover , adversarial examples can transfer across models to mislead other models with a high probability ( Papernot et al. , 2017 ; Liu et al. , 2017 ) . How to effectively defense against adversarial attacks is crucial for security-critical computer vision systems , such as autonomous driving . As a promising approach , adversarial training defends from adversarial perturbations by training a target classifier with adversarial examples . Researchers have found ( Goodfellow et al . ; Kurakin ∗Corresponding author . et al. , 2016b ; Madry et al. , 2018 ) that adversarial training could increase the robustness of neural networks . However , adversarial training often obtains adversarial examples by taking a specific attack technique ( e.g. , FGSM ) into consideration , so the defense targeted such attack and the trained model exhibits weak generalization ability on adversarial examples from other adversaries ( Kurakin et al. , 2016b ) . Tramèr et al . ( 2018 ) showed that the robustness of adversarial training can be easily circumvented by the attack that combines with random perturbation from other models . Accordingly , for most existing adversarial training methods , there is a risk of overfitting to adversarial examples crafted on the original model with the specific attack . In this paper , we propose a novel adversarial training method that is able to improve the generalization of adversarial training . From the perspective of domain adaptation ( DA ) ( Torralba & Efros , 2011 ) , there is a big domain gap between the distribution of clean examples and the distribution of adversarial examples in the high-level representation space , even though adversarial perturbations are imperceptible to humans . Liao et al . ( 2018 ) showed that adversarial perturbations are progressively amplified along the layer hierarchy of neural networks , which maximizes the distance between the original and adversarial subspace representations . In addition , adversarial training simply injects adversarial examples from a specific attack into the training set , but there is still a large sample space for adversarial examples . Accordingly , training with the classification loss on such a training set will probably lead to overfitting on the adversarial examples from the specific attack . Even though Wong & Kolter ( 2018 ) showed that adversarial training with iterative noisy attacks has stronger robustness than the adversarial training with single-step attacks , iterative attacks have a large computational cost and there is no theoretical analysis to justify that the adversarial examples sampled in such way could be sufficiently representative for the adversarial domain . Our contributions are focused on how to improve the generalization of adversarial training on the simple yet scalable attacks , such as FGSM ( Goodfellow et al. ) . The key idea of our approach is to formulate the learning procedure as a domain adaptation problem with limited number of target domain samples , where target domain denotes adversarial domain . Specifically , we introduce unsupervised as well as supervised domain adaptation into adversarial training to minimize the gap and increase the similarity between the distributions of clean examples and adversarial examples . In this way , the learned models generalize well on adversarial examples from different ` ∞ bounded attacks . We evaluate our ATDA method on standard benchmark datasets . Empirical results show that despite a small decay of accuracy on clean data , ATDA significantly improves the generalization ability of adversarial training and has the transfer ability to extend to adversarial training on PGD ( Madry et al. , 2018 ) . 2 BACKGROUND AND RELATED WORK . In this section , we introduce some notations and provides a brief overview of the current advanced attack methods , as well as the defense methods based on adversarial training . 2.1 NOTATION . Denote the clean data domain and the adversarial data domain byD andA respectively , we consider a classifier based on a neural network f ( x ) : Rd → Rk . f ( x ) outputs the probability distribution for an input x ∈ [ 0 , 1 ] d , and k denotes the number of classes in the classification task . Let ϕ be the mapping at the logits layer ( the last neural layer before the final softmax function ) , so that f ( x ) = softmax ( ϕ ( x ) ) . Let be the magnitude of the perturbation . Let xadv be the adversarial image computed by perturbing the original image x . The cost function of image classification is denoted as J ( x , y ) . We define the logits as the logits layer representation , and define the logit space as the semantic space of the logits layer representation . We divide attacks into two types : white-box attacks have the complete knowledge of the target model and can fully access the model ; black-box attacks have limited knowledge of the target classifier ( e.g. , its architecture ) but can not access the model weights . 2.2 ATTACK METHODS . We consider four attack methods to generate adversarial examples . For all attacks , the components of adversarial examples are clipped in [ 0 , 1 ] . Fast Gradient Sign Method ( FGSM ) . Goodfellow et al . introduced FGSM to generate adversarial examples by applying perturbations in the direction of the gradient . xadv = x+ · sign ( ∇xJ ( x , ytrue ) ) ( 1 ) As compared with other attack methods , FGSM is a simple , yet fast and efficient adversary . Accordingly , FGSM is particularly amenable to adversarial training . Projected Gradient Descent ( PGD ) . The Projected Gradient Descent ( PGD ) adversary was introduced by Madry et al . ( 2018 ) without random start , which is a stronger iterative variant of FGSM . This method applies FGSM iteratively for k times with a budget α instead of a single step . xadv0 = x xadvt+1 = xadvt + α · sign ( ∇xJ ( xadvt , ytrue ) ) xadvt+1 = clip ( xadvt+1 , xadvt+1 − , xadvt+1 + ) xadv = xadvk ( 2 ) Here clip ( · , a , b ) function forces its input to reside in the range of [ a , b ] . PGD usually yields a higher success rate than FGSM does in the white-box setting but shows weaker capability in the black-box setting . RAND+FGSM ( R+FGSM ) . Tramèr et al . ( 2018 ) proposed R+FGSM against adversarially trained models by applying a small random perturbation of step size α before applying FGSM . x′ = x+ α · sign ( N ( 0d , Id ) ) xadv = x′ + ( − α ) · sign ( ∇xJ ( xadv , ytrue ) ) ( 3 ) Momentum Iterative Method ( MIM ) . MIM ( Dong et al. , 2018 ) is a modification of the iterative FGSM and it won the first place of NIPS 2017 Adversarial Attacks Competition . Its basic idea is to utilize the gradients of the previous t steps with a decay factor µ to update the gradient at step t+ 1 before applying FGSM with a budget α. xadv0 = x , g0 = 0 gt+1 = µ · gt + ∇xJ ( xadvt , ytrue ) ‖∇xJ ( xadvt , ytrue ) ‖1 xadvt+1 = xadvt + α · sign ( gt+1 ) xadvt+1 = clip ( xadvt+1 , xadvt+1 − , xadvt+1 + ) xadv = xadvk ( 4 ) 2.3 PROGRESS ON ADVERSARIAL TRAINING . An intuitive technique to defend a deep model against adversarial examples is adversarial training , which injects adversarial examples into the training data during the training process . First , Goodfellow et al . proposed to increase the robustness by feeding the model with both original and adversarial examples generated by FGSM and by learning with the modified objective function . Ĵ ( x , ytrue ) = αJ ( x , ytrue ) + ( 1− α ) J ( x+ · sign ( ∇xJ ( x , ytrue ) ) , ytrue ) ( 5 ) Kurakin et al . ( 2016b ) scaled the adversarial training to ImageNet ( Russakovsky et al. , 2015 ) and showed better results by replacing half the clean example at each batch with the corresponding adversarial examples . Meanwhile , Kurakin et al . ( 2016b ) discovered the label leaking effect and suggested not to use the FGSM defined with respect to the true label ytrue . However , their approach has weak robustness to the RAND+FGSM adversary . Tramèr et al . ( 2018 ) proposed an ensemble adversarial training to improve robustness on black-box attacks by injecting adversarial examples transferred from a number of fixed pre-trained models into the training data . For adversarial training , another approach is to train only with adversarial examples . Nøkland ( 2015 ) proposed a specialization of the method ( Goodfellow et al . ) that learned only with the objective function of adversarial examples . Madry et al . ( 2018 ) demonstrated successful defenses based on adversarial training with the noisy PGD , which randomly initialize an adversarial example within the allowed norm ball before running iterative attack . However , this technique is difficult to scale to large-scale neural networks ( Kurakin et al. , 2016a ) as the iterative attack increases the training time by a factor that is roughly equal to the number of iterative steps . Wong & Kolter ( 2018 ) developed a robust training method by linear programming that minimized the loss for the worst case within the perturbation ball around each clean data point . However , their approach achieved high test error on clean data and it is still challenging to scale to deep or wide neural networks . As described above , though adversarial training is promising , it is difficult to select a representative adversary to train on and most existing methods are weak in generalization for various adversaries , as the region of the adversarial examples for each clean data is large and contiguous ( Tramèr et al. , 2017 ; Tabacof & Valle , 2016 ) . Furthermore , generating a representative set of adversarial examples for large-scale datasets is computationally expensive . 3 ADVERSARIAL TRAINING WITH DOMAIN ADAPTATION . In this work , instead of focusing on a better sampling strategy to obtain representative adversarial data from the adversarial domain , we are especially concerned with the problem of how to train with clean data and adversarial examples from the efficient FGSM , so that the adversarially trained model is strong in generalization for different adversaries and has a low computational cost during the training . We propose an Adversarial Training with Domain Adaptation ( ATDA ) method to defense adversarial attacks and expect the learned models generalize well for various adversarial examples . Our motivation is to treat the adversarial training on FGSM as a domain adaptation task with limited number of target domain samples , where the target domain denotes adversarial domain . We combine standard adversarial training with the domain adaptor , which minimizes the domain gap between clean examples and adversarial examples . In this way , our adversarially trained model is effective on adversarial examples crafted by FGSM but also shows great generalization on other adversaries .

Summary: This paper addresses the generalization of adversarial training by proposing a new domain adaptation method. In order to have robust defense for adversarial examples, they combine supervised and unsupervised learning for domain adaptation. The idea of domain adaptation is to increase the similarity between clear and adversarial examples. For this purpose, in their objective, they are minimizing the domain shift by aligning the covariance matrix and mean vector of the clean and adversarial examples.