Generalizable Adversarial Training via Spectral Normalization

1 INTRODUCTION . Despite their impressive performance on many supervised learning tasks , deep neural networks ( DNNs ) are often highly susceptible to adversarial perturbations imperceptible to the human eye ( Szegedy et al. , 2013 ; Goodfellow et al. , 2014b ) . These “ adversarial attacks '' have received enormous attention in the machine learning literature over recent years ( Goodfellow et al. , 2014b ; Moosavi Dezfooli et al. , 2016 ; Carlini & Wagner , 2016 ; Kurakin et al. , 2016 ; Papernot et al. , 2016 ; Carlini & Wagner , 2017 ; Papernot et al. , 2017 ; Madry et al. , 2018 ; Tramèr et al. , 2018 ) . Adversarial attack studies have mainly focused on developing effective attack and defense schemes . While attack schemes attempt to mislead a trained classifier via additive perturbations to the input , defense mechanisms aim to train classifiers robust to these perturbations . Although existing defense methods result in considerably better performance compared to standard training methods , the improved performance can still be far below the performance in non-adversarial settings ( Athalye et al. , 2018 ; Schmidt et al. , 2018 ) . A standard adversarial training scheme involves fitting a classifier using adversarially-perturbed samples ( Szegedy et al. , 2013 ; Goodfellow et al. , 2014b ) with the intention of producing a trained classifier with better robustness to attacks on future ( i.e . test ) samples . Madry et al . ( 2018 ) provides a robust optimization interpretation of the adversarial training approach , demonstrating that this strategy finds the optimal classifier minimizing the average worst-case loss over an adversarial ball centered at each training sample . This minimax interpretation can also be extended to distributionally-robust training methods ( Sinha et al. , 2018 ) where the offered robustness is over a Wasserstein-ball around the empirical distribution of training data . Recently , Schmidt et al . ( 2018 ) have shown that standard adversarial training produces networks that generalize poorly . The performance of adversarially-trained DNNs over test samples can be significantly worse than their training performance , and this gap can be far greater than the generalization ∗Equal Contributors gap achieved using standard empirical risk minimization ( ERM ) . This discrepancy suggests that the overall adversarial test performance can be improved by applying effective regularization schemes during adversarial training . In this work , we propose using spectral normalization ( SN ) ( Miyato et al. , 2018 ) as a computationallyefficient and statistically-powerful regularization scheme for adversarial training of DNNs . SN has been successfully implemented and applied for DNNs in the context of generative adversarial networks ( GANs ) ( Goodfellow et al. , 2014a ) , resulting in state-of-the-art deep generative models for several benchmark tasks ( Miyato et al. , 2018 ) . Moreover , SN ( Tsuzuku et al. , 2018 ) and other similar Lipschitz regularization techniques ( Cisse et al. , 2017 ) have been successfully applied in non-adversarial training settings to improve the robustness of ERM-trained networks to adversarial attacks . The theoretical results in ( Bartlett et al. , 2017 ; Neyshabur et al. , 2017a ) and empirical results in ( Yoshida & Miyato , 2017 ) also suggest that SN can close the generalization gap for DNNs in non-adversarial ERM setting . On the theoretical front , we extend the standard notion of margin loss to adversarial settings . We leverage the PAC-Bayes generalization framework ( McAllester , 1999 ) to prove generalization bounds for spectrally-normalized DNNs in terms of our defined adversarial margin loss . We obtain adversarial generalization error bounds for three well-known gradient-based attack schemes : fast gradient method ( FGM ) ( Goodfellow et al. , 2014b ) , projected gradient method ( PGM ) ( Kurakin et al. , 2016 ) , and Wasserstein risk minimization ( WRM ) ( Sinha et al. , 2018 ) . Our theoretical analysis shows that the adversarial generalization error will vanish by applying SN to all layers . On the empirical front , we show that SN can significantly improve the test performance of adversarially-trained DNNs . We perform numerical experiments over various standard datasets and DNN architectures . In almost all of our experiments , we obtain a better test performance after applying SN . For example , Figure 1 shows the training and validation performance for AlexNet fit on the CIFAR10 dataset using FGM , PGM , and WRM , resulting in adversarial test accuracy improvements of 9 , 11 , and 4 percent , respectively . To perform our numerical experiments , we develop a computationally-efficient approach for normalizing the spectral norm of convolution layers with arbitrary stride and padding schemes . To summarize , the main contributions of this work are : 1 . Proposing SN as a regularization scheme for adversarial training of DNNs , 2 . Extending concepts of margin-based generalization analysis to adversarial settings and proving margin-based generalization bounds for three gradient-based adversarial attack schemes , 3 . Developing an efficient method for normalizing the spectral norm of convolutional layers in deep convolution networks , 4 . Numerically demonstrating the improved test and generalization performance of DNNs trained with SN . 2 PRELIMINARIES . In this section , we first review some standard concepts of margin-based generalization analysis in learning theory . We then extend these notions to adversarial training settings . 2.1 SUPERVISED LEARNING , DEEP NEURAL NETWORKS , GENERALIZATION ERROR . Consider samples { ( x1 , y1 ) , . . . , ( xn , yn ) } drawn i.i.d from underlying distribution PX , Y . We suppose X ∈ X and Y ∈ { 1 , 2 , . . . , m } where m represents the number of different labels . Given loss function ` and function class F = { fw , w ∈ W } parameterized by w , a supervised learner aims to find the optimal function in F minimizing the expected loss ( risk ) averaged over the underlying distribution P . We consider Fnn as the class of d-layer neural networks with h hidden units per layer and activation functions σ : R→ R. Each fw : X → Rm in Fnn maps a data point x to an m-dimensional vector . Specifically , we can express each fw ∈ Fnn as fw ( x ) = Wdσ ( Wd−1 · · ·σ ( W1x ) · · · ) ) . We use ‖Wi‖2 to denote the spectral norm of matrix Wi , defined as the largest singular value of Wi , and ‖Wi‖F to denote Wi ’ s Frobenius norm . A classifier fw ’ s performance over the true distribution of data can be different from the training performance over the empirical distribution of training samples P̂ . The difference between the empirical and true averaged losses , evaluated on respectively training and test samples , is called the generalization error . Similar to Neyshabur et al . ( 2017a ) , we evaluate a DNN ’ s generalization performance using its expected margin loss defined for margin parameter γ > 0 as Lγ ( fw ) : = P ( fw ( X ) [ Y ] ≤ γ + max j 6=Y fw ( X ) [ j ] ) , ( 1 ) where fw ( X ) [ j ] denotes the jth entry of fw ( X ) ∈ Rm . For a given data point X , we predict the label corresponding to the maximum entry of fw ( X ) . Also , we use L̂γ ( fw ) to denote the empirical margin loss averaged over the training samples . The goal of margin-based generalization analysis is to provide theoretical comparison between the true and empirical margin risks . 2.2 ADVERSARIAL ATTACKS , ADVERSARIAL TRAINING . A supervised learner observes only the training samples and hence does not know the true distribution of data . Then , a standard approach to train a classifier is to minimize the empirical expected loss ` over function class F = { fw : w ∈ W } , which is min w∈W 1 n n∑ i=1 ` ( fw ( xi ) , yi ) . ( 2 ) This approach is called empirical risk minimization ( ERM ) . For better optimization performance , the loss function ` is commonly chosen to be smooth . Hence , 0-1 and margin losses are replaced by smooth surrogate loss functions such as the cross-entropy loss . However , we still use the margin loss as defined in ( 1 ) for evaluating the test and generalization performance of DNN classifiers . While ERM training usually achieves good performance over DNNs , several recent observations reveal that adding some adversarially-chosen perturbation to each sample can significantly drop the trained DNN ’ s performance . Given norm function ‖ · ‖ and adversarial noise power > 0 , the adversarial additive noise for sample ( x , y ) and classifier fw is defined to be δadvw ( x ) : = argmax ‖δ‖≤ ` ( fw ( x + δ ) , y ) . ( 3 ) To provide adversarial robustness against the above attack scheme , a standard technique , which is called adversarial training , follows ERM training over the adversarially-perturbed samples by solving min w∈W 1 n n∑ i=1 ` ( fw ( xi + δ adv w ( xi ) ) , yi ) : = min w∈W 1 n n∑ i=1 max ‖δi‖≤ ` ( fw ( xi + δi ) , yi ) . ( 4 ) However , ( 3 ) and ( 4 ) are intractable optimization problems . Therefore , several schemes have been proposed in the literature to approximate the optimal solution of ( 3 ) . In this work , we analyze the generalization performance of the following three gradient-based methods for approximating the solution to ( 3 ) . We note that several other attack schemes such as DeepFool ( Moosavi Dezfooli et al. , 2016 ) , CW attacks ( Carlini & Wagner , 2017 ) , target and least-likely attacks ( Kurakin et al. , 2016 ) have been introduced and examined in the literature , which can lead to interesting future directions for this work . 1 . Fast Gradient Method ( FGM ) ( Goodfellow et al. , 2014b ) : FGM approximates the solution to ( 3 ) by considering a linearized DNN loss around a given data point . Hence , FGM perturbs ( x , y ) by adding the following noise vector : δfgmw ( x ) : = argmax ‖δ‖≤ δT∇x ` ( fw ( x ) , y ) . ( 5 ) For the special case of ` ∞-norm ‖ · ‖∞ , the above representation of FGM recovers the fast gradient sign method ( FGSM ) where each data point ( x , y ) is perturbed by the -normalized sign vector of the loss ’ s gradient . For ` 2-norm ‖ · ‖2 , we similarly normalize the loss ’ s gradient vector to have Euclidean norm . 2 . Projected Gradient Method ( PGM ) ( Kurakin et al. , 2016 ) : PGM is the iterative version of FGM and applies projected gradient descent to solve ( 3 ) . PGM follows the following update rules for a given r number of steps : ∀1 ≤ i ≤ r : δpgm , i+1w ( x ) : = ∏ B , ‖·‖ ( 0 ) { δpgm , iw ( x ) + αν ( i ) w } , ( 6 ) ν ( i ) w : = argmax ‖δ‖≤1 δT∇x ` ( fw ( x + δ pgm , i w ( x ) ) , y ) . Here , we first find the direction ν ( i ) w along which the loss at the ith perturbed point changes the most , and then we move the perturbed point along this direction by stepsize α followed by projecting the resulting perturbation onto the set { δ : ‖δ‖ ≤ } with -bounded norm . 3 . Wasserstein Risk Minimization ( WRM ) ( Sinha et al. , 2018 ) : WRM solves the following variant of ( 3 ) for data-point ( x , y ) where the norm constraint in ( 3 ) is replaced by a norm-squared Lagrangian penalty term : δwrmw ( x ) : = argmax δ ` ( fw ( x + δ ) , y ) − λ 2 ‖δ‖2 . ( 7 ) As discussed earlier , the optimization problem ( 3 ) is generally intractable . However , in the case of Euclidean norm ‖ · ‖2 , if we assume∇x ` ( fw ( x ) , y ) ’ s Lipschitz constant is upper-bounded by λ , then WRM optimization ( 7 ) results in solving a convex optimization problem and can be efficiently solved using gradient methods . To obtain efficient adversarial defense schemes , we can substitute δfgmw , δ pgm w , or δ wrm w for δ adv w in ( 4 ) . Instead of fitting the classifier over true adversarial examples , which are NP-hard to obtain , we can instead train the DNN over FGM , PGM , or WRM-adversarially perturbed samples .

Summary: This paper proposes using spectral normalization (SN) as a regularization for adversarial training, which is based on [Miyato et. al., ICLR 2018], where the original paper used SN for GAN training. The paper also uses the results from [Neyshabur et. al., ICLR 2018], where the original paper provided generalization bounds that depends on spectral norm of each layer.