Improving Local Effectiveness for Global Robustness Training

1 INTRODUCTION . With the proliferation of deep neural networks ( DNN ) in areas including computer vision , natural language processing and speech recognition , there has been a growing concern over their safety . For example , Szegedy et al . ( 2013 ) demonstrated that naturally trained DNNs are in fact fragile . By adding to each data a perturbation that is carefully designed but imperceptible to humans , DNNs previously reaching almost 100 % accuracy performance could hardly make a correct prediction any more . This could cause serious issues in areas such as autonomous navigation or personalised medicine , where an incorrect decision can endanger life . To tackle these issues , training DNNs that are robust to small perturbations has become an active area of research in machine learning . Various algorithms have been proposed ( Papernot et al. , 2016 ; Kannan et al. , 2018 ; Zhang et al. , 2019b ; Qin et al. , 2019 ; Moosavi-Dezfooli et al. , 2020 ; Madry et al. , 2018 ; Ding et al. , 2020 ) . Among them , adversarial training ( ADV ) ( Madry et al. , 2018 ) and TRADES ( Zhang et al. , 2019b ) are two of the most frequently used training methods so far . Although developed upon different ideas , both methods require using strong adversarial attacks , generally computed through several steps of projected gradient descent . Such attacks can quickly become prohibitive when model complexity and input dimensions increase , thereby limiting their applicability . Since the cost of finding strong adversaries is mainly due to the high number of gradient steps performed , one potential approach to alleviate the problem is to use cheap but weak adversaries . Weak adversaries are obtained using fewer gradient steps , and in the extreme case with a single gradient step . Based on this idea , Wong et al . ( 2020 ) argue that by using random initialization and a larger step-size , adversarial training with weak adversaries found via one gradient step is sufficient to achieve a satisfactory level of robustness . We term this method as one-step ADV from now on . While one-step ADV does indeed exhibit robustness , there is still a noticeable gap when compared with its multi-step counterpart . In this paper , we further bridge the gap by proposing a new robust training algorithm : Adversarial Training via LocAl Stability ( ATLAS ) . Local stability , in our context , implies stability of prediction and is the same as local robustness . Specifically , we make the following contributions : • We adopt a new perspective on robust accuracy and introduce a framework for constructing robust training losses that allow more effective use of adversaries . The framework consists of a local component and a global component . The local component maximizes the effectiveness of an given adversary by improving the network ’ s robustness on both the adversary and points around it . In other words , the local component attempts to increase the radius of a ball centered at the adversary on which the network is being robust . The global component combines all local balls in a regularized way to achieve the desired overall robust performance . • Based on the framework and guided by the need of fast robust training , we propose our novel robust training algorithm ATLAS . • We show that ATLAS makes a more effective use of weak adversaries by favourably comparing it against one-step ADV on three datasets : MNIST , CIFAR-10 and CIFAR-100 . • Although one-step ATLAS is more expensive than its other one-step counterparts , ATLAS still allows efficient robust training . We show that , with a one-step weak adversary , ATLAS manages to achieve comparable levels of robust accuracy to multi-step state of the art methods on all datasets . • Finally , we show that when strong adversaries are used , ATLAS matches with the current state of the art on MNIST and outperforms them on CIFAR-10 and CIFAR-100 . 2 RELATED WORKS . Robust training aims to learn a network such that it is able to give the same correct output even when the input is slightly perturbed . Existing robust training algorithms can be divided into two categories : natural image based methods and adversaries based methods . Within the first category , the common form of loss is a natural loss term plus a regularizer computed at natural images . We briefly mention some of these methods . Moosavi-Dezfooli et al . ( 2020 ) observed empirically that reducing the curvature of the loss function and the decision boundary could lead to robust models . The authors thus propose a regularizer based on the Hessian of the loss function . Closely related is the regularizer , introduced in ( Jakubovitz & Giryes , 2018 ; Hoffman et al. , 2019 ; Ross & Doshi-Velez , 2018 ) , that penalizes the Frobenius norm of the Jacobian of the loss function . Jacobian regularizer can also be seen as a way of reducing the curvature of the decision boundary ( Jakubovitz & Giryes , 2018 ) . Although calculating the norm is computationally expensive , a fast estimator with empirically high accuracy has been developed in Hoffman et al . ( 2019 ) . We focus on adversary based robust training , as they generally perform better in terms of robust accuracy . Under this category , an early fundamental work is the Fast Gradient Sign Method ( FGSM ) by Goodfellow et al . ( 2015 ) . Adversarial Training ( ADV ) ( Madry et al. , 2018 ) is a multi-step variant of FGSM . Rather than using one step FGSM , ADV employs multi-step projected gradient descent ( PGD ) ( Kurakin et al. , 2016 ) with smaller step-sizes to generate perturbed inputs . These modifications have allowed ADV to become one of the most effective robust training methods so far ( Athalye et al. , 2018 ) . Another frequently used robust training method is TRADES ( Zhang et al. , 2019b ) . Motivated by its theoretical analyses of the trade-off between natural accuracy and robust accuracy in a binary classification example , TRADES encourages model robustness by adding to the natural loss a regularizer involving adversaries to push away the decision boundary . Recently , Qin et al . ( 2019 ) suggest that a robust model can be learned through promoting linearity in the vicinity of the training examples . They designed a local linearity regularizer ( LLR ) , in which adversaries are used to maximize the penalty for non-linearity . Applying LLR also allows efficient robust training . We note that the underlying idea of LLR is complementary to ATLAS . In addition , several works have suggested to adopt input dependent treatments . These works include incorporating the fact of whether the given input is correctly classified ( Wang et al. , 2020 ) and using adaptive perturbation for different inputs ( Ding et al. , 2019 ) . One major drawback of adversary based methods ( Madry et al. , 2018 ; Zhang et al. , 2019b ; Qin et al. , 2019 ; Wang et al. , 2020 ; Ding et al. , 2019 ) is that most of them rely on strong adversaries , computed via expensive PGD . When the input dimension is high and the model structure is complicated , finding adversaries can be too expensive for these methods to work effectively . Several works have researched possible ways to speed up the process . Algorithmically , Zhang et al . ( 2019a ) cut down the total number of full forward and backward passes for generating multi-step PGD adversaries while Zhang et al . ( 2020 ) introduce a parameter to allow early stop PGD . Shafahi et al . ( 2019 ) reduce adversary overhead by combining weight update and input perturbation update within a single back propagation and use a single step FGSM adversary . Wong et al . ( 2020 ) argue that the main reason one-step FGSM , generally regarded as not robust , is effective in ( Shafahi et al. , 2019 ) is due to the non-zero initialization used . As a result , Wong et al . ( 2020 ) proposed that with random initialization and a larger step size , weak adversaries generated by FGSM could lead to models with a high level of robust accuracy . In this study , we adopt a similar viewpoint of accelerating robust training through the use of weak adversaries . 3 PRELIMINARIES AND NOTATIONS . We consider classification tasks . Let x be an image from the data distribution X ⊂ RN and yx be its correct label from classes C = { 1 , . . . , C } . We denote a neural network , parameterized by θ , as f ( x ; θ ) : X → RC . The function f outputs logits and the predicted class label is chosen to be the element with the largest scalar value . Given a supervised dataset , the parameters θ are obtained by minimizing a loss function ` over the dataset . In natural training , a common loss choice is the cross-entropy loss , denoted as ` CE . To compute ` CE , we need prediction probabilities p ( x ; θ ) , which is evaluated as pi ( x ; θ ) = exp ( fi ( x ; θ ) ) ∑ j exp ( fj ( x ; θ ) ) element-wise . Given a tolerance level and a distance measure norm Lp , we say the network f is robust to adversaries at a given point x ∈ X , if it satisfies arg max i∈C fi ( x ′ ; θ ) = arg max i∈C fi ( x ; θ ) , ∀x′ s.t ‖x′ − x‖p ≤ . ( 1 ) We equivalently use a ball B ( x ) = { x′ | ‖x′ − x‖p ≤ } to represent the allowed perturbation . If f is robust on B , we call B a robust ball . Evaluating the true robustness of f on X is challenging . In practice , we replace X with a test set and evaluate the robustness of f by measuring the percentage of the test set satisfying the condition in equation ( 1 ) . To check whether the condition is met , various attack strategies are applied . Commonly used attacks are PGD based . To be specific , PGD performs the following gradient step during each iteration t+ 1 , xt+1 = ΠB ( x ) ( xt + ξ · sgn ( ∇x ` ( f ( xt ; θ ) ) , y ) ) , ξ < , ( 2 ) and repeats the iteration several times . Here , sgn denotes the sign function . On the other hand , FGSM uses a single gradient step x′ = x+ · sgn ( ∇x ` ( f ( x ; θ ) ) , y ) . ( 3 ) Finally , we introduce the following notation to facilitate the discussion . We first assume that the neural network f contains ReLU activation for the sake of clarity . This implies that the neural network is piecewise linear . As a consequence , at each x ∈ X , it is easy to find a weight matrix Wx ∈ RC×N and a constant vector bx ∈ RC such that f ( x ; θ ) = Wxx+ bx . To simplify the notation , we define W̆x = [ Wx | bx ] ∈ RC× ( N+1 ) , x̆T = [ xT | 1 ] ∈ R1× ( N+1 ) . ( 4 ) As a result , at each point x , we have f ( x ; θ ) = W̆xx̆ . Before we delve in to the details of the algorithm ATLAS , we first introduce a new framework for designing robust training losses .

Summary: The paper proposes a new adversarial training scheme, LEAP, to obtain models robust against $\ell_\infty$-bounded adversarial examples. The loss used as the objective minimized during training involves both local and global (wrt the input space) properties of the network. Experiments suggest improved performance compared to single and multi-step standard adversarial training and TRADES.