TOWARDS NATURAL ROBUSTNESS AGAINST ADVERSARIAL EXAMPLES

1 INTRODUCTION . Deep neural networks have made great progress in numerous domains of machine learning , especially in computer vision . But Szegedy et al . ( 2013 ) found that most of the existing state-of-theart neural networks are easily fooled by adversarial examples that generated by putting only very small perturbations to the input images . Since realizing the unstability of deep neural networks , researchers have proposed different kinds of methods to defense adversarial examples , such as adversarial training ( Goodfellow et al. , 2014 ) , data compression ( Dziugaite et al. , 2016 ) , and distillation defense ( Papernot et al. , 2016 ) . But each of these methods is a remedy for the original problem , and none of these methods can solve it fundamentally . For example , Moosavi-Dezfooli et al . ( 2016 ) showed that no matter how much adversarial examples are added to training sets , there are new adversarial examples that can successfully attack the adversarial trained deep neural network . So , avoiding adversarial examples technically can not solve the most essential problem : why such subtle change in adversarial examples can beat deep neural networks ? Meanwhile , it leads to a more important question : how to make deep neural networks have natural robustness so that they can get rid of malicious adversarial examples . Early explanations for adversarial examples considered that a smoothness prior is typically valid for kernel methods that imperceptibly tiny perturbations of a given image do not normally change the underlying class , while the smoothness assumption does not hold for deep neural networks due to its high non-linearity ( Szegedy et al. , 2013 ) . This analysis underlies plain deep neural networks like AlexNet ( Krizhevsky et al. , 2012 ) . But later than that , Goodfellow et al . ( 2014 ) claim adversarial examples are a result of models being too linear rather than too non-linear , they can be explained as a property of high-dimensional dot products . Unfortunately , both of these explanations seem to imply that adversarial examples are inevitable for deep neural networks . On the other hand , we notice that skip connections are widely used in current deep neural networks after the appearance of Highway Network ( Srivastava et al. , 2015 ) and ResNet ( He et al. , 2016 ) . It turns out that the identity mapping in ResNet is formally equivalent to one step of Euler ’ s method which has been used to solve ordinary differential equations ( Weinan , 2017 ) . More than that , other kinds of skip connections used by different network architectures can be considered as different numerical methods for solving ordinary differential equations . The link between numerical ordinary differential equations with deep neural networks can bring us a whole new perspective to explain adversarial examples through the numerical stability analysis . In this paper , we attempt to utilize the natural property of neural networks to defense adversarial examples . We first analyze how adversarial examples affect the output of neural networks with identity mappings , obtain an upper bound for this kind of neural networks , and find that this upper bound is impractical in actual computations . In the same way , we figure out why adversarial examples can fool commonly used deep neural networks with skip connections . Then , we demonstrate that Neural ODEs hold a weaker upper bound and verify the natural robustness of Neural ODEs under four types of perturbations . Finally , we compare Neural ODEs with three types of adversarial training methods to show that the natural robustness of Neural ODEs is better than the robustness of neural networks that are trained with adversarial training . The main contributions of our work are as follows : • We introduce and formalize the numerical stability analysis for deep neural networks with identity mappings , prove that there is an upper bound for neural networks with identity mappings to constrain the error caused by adversarial noises . • We provide a new reason why commonly used deep neural networks with skip connections can not resist adversarial examples . • We demonstrate that Neural ODEs hold a weaker upper bound which limits the amount of change in the result from being too large . Compare with ResNet and three types of adversarial training methods , we show the natural robustness of Neural ODEs . 2 RELATED WORKS . 2.1 ADVERSARIAL DEFENSE . Adversarial training typically uses a robust optimization to generate adversarial examples for training deep neural networks . Madry et al . ( 2017 ) take the optimization as a saddle point problem . Zhang et al . ( 2019a ) cast adversarial training as a discrete time differential game . Adversarial training can be seen as a data augmentation particularly enhance the robustness to white-box attacks ( Tramèr et al. , 2017 ) . Zantedeschi et al . ( 2017 ) augmented the training sets with examples perturbed using Gaussian noises which can also enhance the robustness to black-box attacks . Lee et al . ( 2017 ) proposed a novel adversarial training method using a generative adversarial network framework . Besides , Finlay et al . ( 2018 ) augmented adversarial training with worst case adversarial training which improves adversarial robustness in the ` 2 norm on CIFAR10 . Modifying the neural networks by using auto encoders , input gradient regularization and distillation can result in robustness against adversarial attacks ( Bai et al. , 2017 ; Ross & Doshi-Velez , 2017 ; Papernot et al. , 2016 ) . Besides , there are some biologically inspired deep learning models designed to have natural robustness against adversarial examples . Nayebi & Ganguli ( 2017 ) developed a scheme similar to nonlinear dendritic computation to train deep neural networks to make them robust to adversarial attacks . Krotov & Hopfield ( 2018 ) proposed Dense Associative Memory ( DAM ) models and suggested that DAM with higher order energy functions are closer to human visual perception than deep neural networks with ReLUs . In addition to augmenting datasets or modifying original neural networks , there exist adversarial defense methods that rely on using external models and detecting adversarial examples . Akhtar et al . ( 2018 ) presented Perturbation Rectifying Network ( PRN ) as ‘ pre-input ’ layers to a targeted model , if a perturbation is detected , the output of the PRN is used for label prediction instead of the actual image . Xu et al . ( 2017 ) proposed a strategy called feature squeezing to reduce the search space available to an adversary by coalescing samples that correspond to many different feature vectors in the original space into a single sample . 3 NUMERICAL STABILITY ANALYSIS FOR DNNS . 3.1 RESNET AND EULER ’ S METHOD . The building block of ResNet is defined as yn+1 = yn + f ( yn ; θn ) ( 1 ) Where n ∈ { 0 ... N ( h ) − 1 } , yn and yn+1 are input and output vectors of the layers considered . The function f ( yn ; θn ) represents the residual mapping and θn are weights to be learned . In numerical methods for solving ordinary differential equations , Euler ’ s method is defined by taking this to be exact : yn+1 = yn + hf ( tn , yn ; θn ) ( 2 ) It can be easily seen that Eqn . ( 1 ) is a special case of Euler ’ s method when the step size h = 1 . The iterative updates of ResNet can be seen as an Euler discretization of a continuous transformation ( Lu et al. , 2018 ; Haber & Ruthotto , 2017 ; Ruthotto & Haber , 2019 ) . When the input data is perturbed by adversarial noises , we denote the adversarial example by z0 = y0 + ( 3 ) To perform stability analysis for ResNet with adversarial example z0 as input , we define a numerical solution zn by zn+1 = zn + hf ( tn , zn ; θn ) ( 4 ) and provide following theorem to show that the amount of change between yn and zn holds an upper bound by some assumptions . Theorem 3.1 . Let f ( t , y ; θ ) be a continuous function for t0 ≤ t ≤ b and −∞ < y < ∞ , and further assume that f ( t , y ; θ ) satisfies the Lipschitz condition . Then compare the two numerical solutions yn and zn as h → 0 , there is a constant c ≥ 0 , such that amount of change between yn and zn satisfies max 0≤n≤N ( h ) |zn − yn| ≤ c| | ( 5 ) Proof . Let en = zn − yn , n ≥ 0 . Then e0 = , and subtracting Eqn . ( 2 ) from Eqn . ( 4 ) , we obtain en+1 = en + h [ f ( tn , zn ; θn ) − f ( tn , yn ; θn ) ] ( 6 ) Assume that the derivative function f ( t , y ; θ ) satisfied the following Lipschitz condition : there exists K ≥ 0 such that |f ( t , y1 ; θ ) − f ( t , y2 ; θ ) | ≤ K|y1 − y2| ( 7 ) Taking bounds using Eqn . ( 7 ) , we obtain |en+1| ≤ |en|+ hK̂|zn − yn| ( 8 ) |en+1| ≤ ( 1 + hK̂ ) |en| ( 9 ) where K̂ is the largest Lipschitz constant . Apply this recursively to obtain |en| ≤ ( 1 + hK̂ ) n|e0| ( 10 ) Using the inequality ( 1 + t ) m ≤ emt , for any t ≥ −1 , any m ≥ 0 , we obtain ( 1 + hK ) n ≤ enhK̂ = e ( b−t0 ) K̂ ( 11 ) and this implies the main result Eqn. ( 5 ) . Roughly speaking , theorem 3.1 means that a small adversarial perturbation initial value of the problem leads to a small change in the solution , provided that the function f ( t , y ; θ ) is continuous and the step size h is sufficiently small . Obviously , ResNet does not satisfied the assumption of continuity and its step size h always equal to 1 . Particularly , the functions f ( t , y ; θ ) in ResNet are composite function which contains ReLU activation functions . Although ReLU activation functions g ( x ) = max ( 0 , x ) break the continuity , due to their contractive property , i.e . satisfies ‖g ( x ) − g ( x+ ) ‖ ≤ | | for all x , ; it follows that ‖gn ( x ; θn ) − gn ( x+ ; θn ) ‖ = ‖max ( 0 , θnx+ bn ) −max ( 0 , θn ( x+ ) + bn ) ) ‖ ≤ ‖θn ‖ ≤ ‖θn‖‖ || ( 12 ) This provides a weaker upper bound for ReLU to mitigate the loss of continuity . Even if the step size h in ResNet can be adjusted by multiply outputs of convolution layers by a chosen constant , but unfortunately , the step size h in ResNet can not be too small since a very small step size decreases the efficiency in actual computations . We can experimentally show that when step size h is small ( such as 10−1 , 10−2 and 10−3 ) , ResNet has no obvious robustness against adversarial examples , and when step size is very small ( such as 10−8 , 10−9 , 10−10 ) , ResNet is difficult to train , so not only the classification accuracy of adversarial examples but also the accuracy of clean examples is quite low . To summarize , the main reason for ResNet ’ s failure in adversarial examples is the step size h = 1 destroys the upper bound given by Eqn . ( 5 ) and we can not find a proper way to deal with it . Thus , when the input of ResNet is perturbed by adversarial noises , the amount of change in the result will become unpredictably large so that ResNet can no longer correctly classify the input .

Summary: This paper uses theoretical grounding, starting with Lipshitz continuity-based assumptions on residual connections, to show why such architectures are more susceptible to adversarial inputs. In the process, the authors draw a parallel between these residual connections and neural ODEs, showing how the latter can circumvent the main reason that leads to adversarial susceptibility for the former. Finally, via empirical evaluations, they show how neural ODEs have "natural" robustness to adversarial examples: they have a non-trivial performance on adversarial inputs, despite not being explicitly trained for robustness.