Cycle monotonicity of adversarial attacks for optimal domain adaptation

We reveal an intriguing connection between adversarial attacks and cycle monotone maps , also known as optimal transport maps . Based on this finding , we developed a novel method named source fiction for semi-supervised optimal transportbased domain adaptation . In our algorithm , instead of mapping from target to the source domain , optimal transport maps target samples to the set of adversarial examples . The trick is that these adversarial examples are labeled target samples perturbed to look like source samples for the source domain classifier . Due to the cycle monotonicity of adversarial attacks , optimal transport can naturally approximate this transformation . We conduct experiments on various datasets and show that our method can notably improve the performance of optimal transport methods in semi-supervised domain adaptation . 1 INTRODUCTION . Optimal Transport ( OT ) is a powerful framework to solve mass moving problems for probability distributions . Over the past decades , it has been successfully applied in mathematics ( Ferradans et al. , 2014 ) , economics ( Reich , 2013 ) and machine learning ( Arjovsky et al. , 2017 ; Mroueh , 2019 ; Solomon et al. , 2015 ; Colombo et al. , 2021 ) . The key property of OT maps is a cycle monotonicity ( McCann , 1995 ) , such maps can not be improved ; it is impossible to perturb it and get something more economical ( Villani , 2008 , M5 ) . In machine learning , OT finds a rich application in domain adaptation ( DA ) problem ( Courty et al. , 2015 ; Perrot et al. , 2016 ; Rakotomamonjy et al. , 2020 ) . In DA , the task is to learn a model fθ , e.g. , a classifier , from a source domain Ωs to perform well on a different ( related ) target domain Ωt ( Ben-David et al. , 2010a ) . The conventional OT approach for domain adaptation is to use OT map Ωt → Ωs to transform target domain Ωt to source Ωs and then apply the model fθ to mapped samples . With few labeled samples in target domain Ωsemi we can apply semi-supervised domain adaptation ( Wang & Deng , 2018 ) . For semi-supervised OT , labels are used to prevent the transportation of the target sample into the source sample from another class ( Courty et al. , 2016 ; Yan et al. , 2018 ) . But labels do not provide supervision for the map between two domains because supervision involves input-output pairs , and labels do not give such pairwise matching between source and target samples . Moreover , supervision for OT has to involve a cycle monotone matching between source and target samples and save the class-wise structure . In our paper , we propose an algorithm we call source fiction that provides cycle monotone supervision to OT and improves the performance of OT in semi-supervised DA . The core of this algorithm is our finding that adversarial attacks ( Szegedy et al. , 2014 ) , more precisely Iterative Fast Sign Gradient Descent ( Goodfellow et al. , 2014 , FSGD ) are cycle monotone transformations over the dataset with quadratic cost . We propose to replace source domain Ωs with domain Ωf that is constructed by the adversarial attack on labeled samples in target domain Ωsemi to be accurately classified by source domain classifier fθ . Since domain Ωf is a cycle monotone transformation of the target domain Ωsemi , it becomes natural to use Ωsemi → Ωf as supervision for OT mapping and then use the resulted map to transport from target domain without labels to Ωf . The main contributions of this paper are : ( i ) We prove that an adversarial attack produces cycle monotone transformation of the dataset ( Section 3 ) ; ( ii ) We propose a novel source fiction algorithm for OT-based semi-supervised domain adaptation . The algorithm incorporates the adversarial attack to the conventional pipeline of OT for DA ( Section 4 ) . 2 BACKGROUND AND RELATED WORK . 2.1 ADVERSARIAL ATTACKS . Adversarial examples are samples that are similar to the true samples D ( x , x′ ) ≤ , but “ fool ” a selected classifier and tend it to make incorrect predictions argmax p ( y | x′ ) 6= ytrue ( Szegedy et al. , 2014 ) . The phenomenon of the vulnerability of machine learning models to adversarial examples breeds a great deal of concern in many learning scenarios ( Papernot et al. , 2017 ; Yuan et al. , 2019 ; Schott et al. , 2019 ; Xie et al. , 2017 ) . A large body of work on adversarial attacks exists ; in our paper , we consider Fast Sign Gradient Descent ( FSGD ) by Goodfellow et al . ( 2014 ) ; iterative version of FSGD can be presented as x′0 = x , x ′ i+1 = clipx , { x′i − α sign ( ∇xL ( θ , x′i , y ) ) } ( 1 ) With sample x , the target label y , and classifier f with parameters θ , we can obtain adversarial examples using gradient descent , by solving the min-max problem , maximizing the loss L and minimizing perturbation for a sample x in some class y with respect to some perturbation size . Newly , various properties of adversarial examples were studied ( Petrov & Hospedales , 2019 ; Papernot et al. , 2016 ; Ilyas et al. , 2019 ) , and applications of adversarial examples for models accuracy improvements were proposed ( Xie et al. , 2019 ; Yang et al. , 2020 ) . Previously connection of OT and adversarial examples were studied in the context of robustness problems ( Pydi & Jog , 2020 ; Bouniot et al. , 2021 ) . Wong et al . ( 2019 ) proposed the idea of Wasserstein adversarial attack with Sinkhorn iterations ; this algorithm allows to find adversarial perturbations with respect to Wasserstein ball . 2.2 OPTIMAL TRANSPORT . OT aims at finding a solution to transfer mass from one distribution to another with the least effort . Monge ’ s problem was the first example of the OT problem and can be formally expressed as follows : inf T # µ=ν ∫ Ωµ c ( x , T ( x ) ) µ ( x ) dx ( 2 ) The Monge ’ s formulation of OT aims at finding a mapping T : Ωµ → Ων of the two probability measures µ and ν and a cost function c : Ωµ × Ων → R+ , where T # µs = νt represents the mass preserving push forward operator . In Monge ’ s formulation , T can not split the mass from a single point . The problem is that with such constraints , the mapping T may not even exist . To avoid this problem , Kantorovitch proposed a relaxation ( Villani , 2008 ) . Instead of obtaining a mapping , the goal is to seek a joint distribution over the source and the target that determines how the mass is allocated . For a given cost function c : Ωµ × Ων → R+ , the primal Kantorovitch formulation can be expressed as the following problem : min γ∈Π ( µ , ν ) { ∫ Ωµ×Ων c ( x , y ) dγ ( x , y ) = E ( x , y ) ∼γ [ c ( x , y ) ] } ( 3 ) In primal Kantorovitch formulation , we look for a joint distribution γ with µ and µ as marginals that minimize the expected transportation cost . If the independent distribution γ ( x , y ) = µ ( x ) ν ( y ) respects the constraints , linear program is convex and always has a solution for a semi-continuous c : Π ( µ , ν ) = { γ ∈ P ( Ωµ , Ων ) : ∫ γ ( x , y ) dy = µ ( x ) , ∫ γ ( x , y ) dx = ν ( y ) } ( 4 ) The primal Kantorovitch formulation can be also presented in dual form as stated by the RockafellarFenchel theorem ( Villani , 2008 ) : max φ∈C ( Ωµ ) , ψ∈C ( Ων ) { ∫ φdµ+ ∫ ψdν | φ ( x ) + ψ ( y ) ≤ c ( x , y ) } ( 5 ) After finding a solution to the transport problem , OT provides a measure of dissimilarity between the two distributions . This similarity is also called the Wasserstein distance ( Villani , 2008 ) : Wp ( µs , νt ) = min γ∈Π ( µ , ν ) { ∫ Ωµ×Ων c ( x , y ) dγ ( x , y ) } 1 p ( 6 ) where c ( x , y ) = ‖x− y‖p and p > 1 . The Wasserstein distance encodes the geometry of the space through the optimization problem and can be used on any distribution of mass . The main geometric property of the OT is cycle monotonicity . Informally , a c-cycle monotone plan is a plan that can not be improved , for all points x0 . . . xi , y0 . . . yi holds : N∑ i=1 c ( xi , yi ) ≤ N∑ i=1 c ( xi , yi+1 ) ( 7 ) It is impossible to perturb it and get something more economical ( Villani , 2008 , M5 ) . 2.3 OPTIMAL TRANSPORT FOR DOMAIN ADAPTATION . Domain Adaptation : DA techniques try to make the target domain Ωt samples Xt = ( xti ) Nt i=1 be closer to the source domain Ωs samples Xs = ( xsi ) Ns i=1 to make the source classifier fθ perform accurately on the target domain ( Ben-David et al. , 2010a ; b ; Germain et al. , 2013 ) . In semi-supervised settings , target domain Ωsemi consists of unlabeled samples Xt = ( xti ) Nt i=1 and small number of samples Xl = ( xli ) Nl i=1 associated with labels Yl = ( y l i ) Nl i=1 . These labels can be used to train DA algorithm match target samples with source samples that have the same labels . Different discrete OT algorithms can be applied for domain adaptation ( Courty et al. , 2015 ) . For example , Earth Mover ’ s Distance ( EMD ) ( Courty et al. , 2015 ; Flamary et al. , 2021 ) solves the most typical primal Kantorovich OT problem ( equation 4 ) . This method seeks an optimal coupling γ , which minimizes the displacement cost between two domains with respect to some distance . Sinkhorn algorithm ( Cuturi , 2013 ) and its variations with a group lasso regularization ( L1L2 ) and Laplacian regularization ( L1LP ) ( Courty et al. , 2015 ) are OT algorithms that apply lightspeed computation of OT in DA . Perrot et al . ( 2016 ) proposed Linear OT mapping estimators ( MapT ) that jointly learn the coupling γ equation 4 and transport map T linked to the original Monge problem equation 2 . In semi-supervised DA with OT , labels are used to penalty the transport Ωsemi ( γ ) = 〈γ , M〉 by a ns × nt cost matrix M〉 where M ( i , j ) = 0 when ysi = ytj and +∞ otherwise ( Courty et al. , 2016 ; Yan et al. , 2018 ) . In domain adaptation with label and target shift , OT was used to align probability distributions even for a few domains ( Redko et al. , 2019 ; Rakotomamonjy et al. , 2020 ) . Most of these algorithms are presented in POT library ( Flamary et al. , 2021 ) , which provides state-of-the-art OT algorithms to solve the domain adaptation . Discrete OT : Different discrete OT algorithms can be applied for domain adaptation ( Courty et al. , 2015 ) . For example , Earth Mover ’ s Distance ( EMD ) ( Courty et al. , 2015 ; Flamary et al. , 2021 ) solves the most typical primal Kantorovich OT problem ( equation 4 ) . This method seeks an optimal coupling γ , which minimizes the displacement cost between two domains with respect to some distance . Neural OT : The connection between OT and deep networks was proposed for unsupervised domain adaptation ( Damodaran et al. , 2018 ) and representation transfer between teacher and student in transfer learning ( Li et al. , 2020 ) . It was also shown that mini-batch learning that is correctly applied in deep learning can be employed to OT for efficient measure between data distributions ( Fatras et al. , 2021 ) . Recently , there has been a solid push to incorporate Input Convex Neural Networks ( ICNNs ) ( Amos et al. , 2017 ) in OT problems . According to Rockafellar ’ s Theorem ( Rockafellar , 1966 ) , every cyclical monotone mapping g is contained in a sub-gradient of some convex function f : X → R. Furthermore , according to Brenier ’ s Theorem ( Theorem 1.22 of Santambrogio ( 2015 ) ) , these gradients uniquely solve the Monge problem equation 2 . Following these theorems , a range of approaches explored ICNNs as parameterized convex potentials in dual Kantorovich problem equation 5 ( Taghvaei & Jalali , 2019 ; Makkuva et al. , 2020 ) . Further development of this approach enabled the construction of the non-minimax Wasserstein-2 generative framework ( Korotin et al. , 2019 ) that can solve domain adaptation and Wasserstein-2 Barycenters estimation ( Fan et al. , 2020 ; Korotin et al. , 2021b ) . Compared to discrete OT , neural methods provide generalized OT methods that can ensure out-of-sample estimates . In our paper , in comparison to this method , we do not propose a new domain adaptation algorithm , new OT algorithm , or adversarial attack and defense based on OT . We presented a connection between OT and adversarial attacks and showed how this connection can be used for semi-supervised OT .

Summary: This paper studies the use of adversarial attacks and optimal transport (OT) in the context of semi-supervised domain adaptation. The authors show that adversarial attacks satisfy the cycle monotonicity property. They then propose an algorithm that generates adversarial examples for the labeled target samples using the source classifier, and maps the vanilla target samples to this new domain via OT.