Towards Efficient and Effective Adversarial Training

1 Introduction . The past decade has witnessed the rise of Deep Learning based systems and solutions in many applications related to Computer Vision , Natural Language Processing and Speech Processing . Despite the remarkable success of Deep Networks , they are known to be susceptible to crafted imperceptible noise called Adversarial Attacks [ 27 ] , which can have disastrous implications when deployed in critical applications such as self-driving cars , medical diagnosis and surveillance systems . The robustness of Deep Networks to Adversarial Attacks has been of prime importance , since this relates to improving their worst-case performance [ 6 ] . Early attempts of improving robustness to adversarial attacks could be broadly classified into input pre-processing based defenses [ 4 , 32 , 25 , 13 ] and adversarial training methods [ 11 , 20 ] . While the input pre-processing based defenses were computationally cheap , they primarily involved masking of gradients to prevent the generation of strong attacks . Such methods were later shown to be ineffective against attacks constructed using expectation over the randomized components or smooth approximations of non-differentiable components [ 3 ] . Amongst the latter methods , the most successful early defense which stood the test of time was the Projected Gradient Descent ( PGD ) adversarial training method proposed by Madry et al . [ 20 ] . This involved minimization of cross-entropy loss on the worst-case perturbations generated using multiple iterations of constrained optimization , leading to a significantly higher computational cost when compared to standard training . ∗Equal contribution . Correspondence to : Gaurang Sriramanan < gaurangs @ umd.edu > , Sravanti Addepalli < sravantia @ iisc.ac.in > 35th Conference on Neural Information Processing Systems ( NeurIPS 2021 ) . FGSM ( Fast Gradient Sign Method ) based adversarial training [ 11 ] alleviates the computational cost by utilizing single-step adversarial samples for training . However , this method is contingent on the local linearity assumption of the loss surface , which is often compromised during the process of FGSM training , leading to generation of weaker adversaries as training progresses . This leads to the generation of models which exhibit a false sense of robustness towards single-step attacks and are susceptible to stronger multi-step attacks . Although there have been several recent works [ 29 , 30 , 26 ] to circumvent gradient masking and improve the worst-case accuracy of single-step adversarial training methods , the robustness thus achieved has been suboptimal compared to multi-step defenses . In this work , we improve the effectiveness of single-step adversarial training by introducing a novel Nuclear-Norm regularizer to impose local smoothness in the vicinity of data samples . The proposed Nuclear-Norm Adversarial Training ( NuAT ) utilizes batch statistics to limit the oscillation of function values in the required dimensions , thereby preventing the over-smoothing of loss surface uniformly . We summarize our contributions of our work below : • We propose single-step Nuclear Norm Adversarial Training ( NuAT ) , and a two step variant of the same ( NuAT2 ) , coupled with a novel cyclic-step learning rate schedule , to achieve state-of-the-art results amongst efficient training methods , and results comparable to the effective multi-step training methods . • We demonstrate improved performance by using exponential averaging of the network weights coupled with cyclic learning rate schedule ( NuAT-WA ) . • We propose a two-step variant NuAT2-WA , that utilizes stable gradients from the weightaveraged model for stable initialization in the first attack step , yielding improved results . • We improve the stability and performance of the single-step defense ( NuAT ) further at a marginal increase in computational cost , by introducing a hybrid approach ( NuAT-H ) that switches adaptively between single-step and two-step optimization for attack generation . The organization of this paper is as follows : The preliminaries on notation and threat model are laid out in Section-2 , followed by a brief note on related works in Section-3 and a discussion on challenges in single-step adversarial training in Section-4 . We present a detailed description of our proposed method in Section-5 , followed by experimental results to support our claims in Section-6 . We conclude the paper with our analysis and future directions in Section-7 . Our code and pre-trained models are available here : https : //github.com/val-iisc/NuAT . 2 Preliminaries . In this paper , we denote x to be a d-dimensional image from anN -class datasetD . Further , we denote its corresponding ground-truth label as a one-hot vector y . Let fθ represent a Deep Neural Network with parameters θ , that maps an input image x to its pre-softmax output fθ ( x ) . The cross-entropy loss corresponding to the network prediction on a sample ( x , y ) is denoted as ` CE ( fθ ( x ) , y ) . For a minibatch B = { ( xi , yi ) } Mi=1 , we denote X as the image matrix whose ith row consists of flattened pixel intensities of the image xi , and Y as the corresponding ground-truth array . Thus , X is a matrix of size ( M × d ) , and Y is a matrix of size ( M ×N ) . Let ` CE ( fθ ( X ) , Y ) denote the sum of cross-entropy losses over all data samples in the minibatch B . Further , for a matrix A , let ||A||∗ denote the Nuclear Norm , that is the sum of the singular values of A. Adversarial Threat Model : In this paper , we consider the robustness of Deep Networks against ` ∞ constrained adversaries . Thus under an ε-constraint , given a clean image x , an adversarially perturbed counterpart x̃ can differ by at most ε at any given pixel location . Further , a network fθ is said to be ε-robust on a clean sample x with label y , if fθ ( x̃ ) = y , for all perturbations x̃ such that ||x− x̃||∞ ≤ ε . We note that the proposed approach can be extended to other threat models as well . 3 Related Works . Multi-step Adversarial Defenses : One of the oldest and most effective defenses known till date is the PGD adversarial training introduced by Madry et al . [ 20 ] , wherein the network is trained on strong adversaries generated using multi-step optimization following a random noise initialization . Further , Zhang et al . [ 33 ] proposed TRADES , a multi-step adversarial training method that balances the trade-off between standard accuracy and adversarial robustness . The authors proposed to train the network on adversaries generated by maximising the Kullback-Leibler ( KL ) Divergence , to obtain smooth models reliably and achieve state-of-the-art robust performance . Rice et al . [ 23 ] found that early stopping could be used to alleviate the phenomenon of robust-overfitting , wherein the robust performance of deep networks starts degrading after a certain number of training iterations . Strikingly , it was observed that early-stopping combined with PGD adversarial training could be used to produce significantly more robust models , which out-performed even TRADES based training . In more recent work , Pang et al . [ 21 ] discuss several implementation details with regard to the optimal choice of hyperparameters , and further improve upon the hitherto TRADES defense . Improving the Generalization of Defenses : Wu et al . [ 31 ] explore the use of Adversarial Weight Perturbations ( AWP ) to explicitly enforce a flatter weight loss landscape . Perturbations are generated in both input space and weight space during the training regime , to maximize loss with respect to both . This is seen to significantly improve robust performance , albeit with an increased computational cost . Prior works [ 14 ] show that Stochastic Weight Averaging ( SWA ) can be used to train networks with flatter and wider minima to obtain improved generalisation in the context of standard training , as compared to solutions obtained using traditional Stochastic Gradient Descent ( SGD ) . In a very recent work , Gowal et al . [ 12 ] investigate the effect of factors such as choice of activation functions , use of additional unlabelled data , as well as the application of exponential model weight averaging to boost the adversarial performance of multi-step defenses . In contrast , we propose to additionally incorporate adversaries generated from the Stochastic Weight Averaged model in order to generate stable and effective perturbations . Thus , by additionally utilising supervision from the weight-averaged model during 2-step adversarial training ( NuAT2-WA ) , the efficacy of the defense is enhanced . Efficient Adversarial Training : While multi-step adversarial methods continue to achieve the best robust performance , their computational complexity poses a severe impediment to their deployment in real-world applications that utilize large-scale datasets . Several works have been proposed to efficiently train robust models ; by training without the use of adversaries during training [ 1 ] , reusing gradient computations [ 24 ] , or by utilising single-step adversarial training [ 30 , 29 , 26 ] . We expound upon the latter methods in Section-4 . Nuclear Norm Regularization : Optimization objectives utilizing the Nuclear Norm regularizer have seen extensive use in several computer vision , compressed sensing and machine learning applications such as in image denoising [ 15 ] , low-rank matrix completion [ 5 ] and multi-task learning [ 22 ] . The Nuclear Norm provides a tight convex relaxation for the rank of a matrix , and can thus be successfully used as a surrogate objective to approximately solve intractable optimization problems . In this work , we seek to utilize Nuclear Norm regularization to enforce consistent network predictions within the vicinity of clean data samples in efficient adversarial training , as discussed in Section-5 . 4 Analysis of Single-Step Adversarial Training . FGSM Adversarial Training : The efficacy of single-step approximation for generating adversarial attacks was first demonstrated by Goodfellow et al . [ 11 ] . The single-step FGSM attack was found to be sufficient to compromise the accuracy of models trained using empirical risk minimization . These single-step adversaries were further used for adversarial training ( FGSM-AT ) , where the original dataset is augmented with some proportion of FGSM adversarial samples . However , it was later found that the resulting models were not robust to multi-step attacks due to the gradient masking effect [ 17 ] . The FGSM-AT loss formulation , which combines cross-entropy loss on clean and single-step adversarial samples , has two possible solutions . First is the desired solution , where the loss surface of the trained network continues to remain locally linear as training progresses , resulting in the generation of strong single-step adversaries , thereby facilitating the training of robust models . The second is a degenerate solution , where the model develops a convoluted loss surface , which undermines the linearity assumption required for the generation of effective single-step adversaries . Since the adversaries used for training are not effective , the adversarially trained model is not robust to multi-step attacks . This indeed results in a better minimizer of the training objective , since generating weak adversaries would result in a lower cross-entropy loss on both clean and adversarial samples . In practice , as training progresses , the loss surface starts deviating increasingly from the first-order assumption . This reduces the efficacy of FGSM samples , leading the training process to converge to the degenerate solution . Fig.1 ( b ) shows the loss surface of an FGSM trained model , where the gradients at the vicinity of the sample are masked , thereby preventing single-step methods from reaching a true maximum in the ε-ball . It can be observed that traversal along the gradient direction ( δ1 ) does not result in increased loss , preventing the generation of strong single-step adversaries . R-FGSM Adversarial Training : R-FGSM adversarial training [ 28 ] attempts to escape the gradient masking effect by computing gradients at a random point in the vicinity of the data sample . This relies on the assumption that gradients would remain constant in the local neighbourhood of data samples when the loss surface is smooth . However , this assumption can fail in case of gradient masking , leading to the generation of weak adversaries , which is termed as catastrophic overfitting in subsequent works [ 30 ] . Although Wong et al . [ 30 ] demonstrated successful R-FGSM training by adding larger magnitudes of noise before attack ( FBF ) , and using shorter training schedules , the models trained were not competent with multi-step adversarial training methods . Also , this method does not improve robustness on larger models like WideResNet , as shown in subsequent works [ 26 ] . Regularizers to Mitigate Gradient Masking : One of the effective methods of mitigating gradient masking has been the use of regularizers to improve local smoothness of the loss surface [ 29 , 26 ] . Sriramanan et al . [ 26 ] propose Guided Adversarial Training ( GAT ) to obtain significant gains in adversarial robustness when compared to R-FGSM training [ 30 ] by imposing an ` 2 regularizer on the difference between softmax values of clean samples and their corresponding single-step adversaries . While this has proved to be the most effective strategy for single-step adversarial training , the results obtained are not on par with multi-step defenses . The ` 2 regularizer introduced in GAT [ 26 ] attempts to uniformly limit the oscillation of the network outputs along all dimensions . While this successfully prevents the onset of gradient masking , it imposes an overly severe constraint on the outputs of the network , thereby limiting the network from learning the true underlying function . This results in a larger robustness-accuracy trade-off when compared to multi-step adversarial training . Although function smoothness is a result of PGD adversarial training as well ( as shown in Fig.1 ( c ) ) , the absence of an explicit regularizer allows more degrees of freedom for the function learned . In this work , we introduce a novel Nuclear-Norm based regularizer that utilizes batch-statistics for achieving function smoothing only in the required dimensions , and to the required extent . This prevents over-smoothing of the loss function , resulting in significant performance gains . We discuss details on the proposed Nuclear-Norm Adversarial Training ( NuAT ) algorithm and analyse properties of models trained using this regularizer in the following section .

Summary: The paper addresses the performance gap between single-step and multi-step adversarial training by introducing a Nuclear Norm regularizer to improve the adversarial robustness of models in single-step adversarial training. It shows that this regularizer encourages function smoothing near clean samples by incorporating joint batch-statistics of adversarial samples, which leads to increased robustness. The authors also use exponential weight-averaging and a 2-step variant of the proposed defense to further improve the performance. Experiments on MNIST, CIFAR-10 and ImageNet-100 demonstrate that the proposed method outperforms single-step adversarial training methods and is competitive with multi-step methods in terms of robustness (while being more computationally efficient).