Analytical Moment Regularizer for Training Robust Networks

1 INTRODUCTION . Deep neural networks ( DNNs ) have emerged as generic models that can be trained to perform impressively well in a variety of learning tasks ranging from object recognition ( He et al. , 2016 ) and semantic segmentation ( Long et al. , 2015 ) to speech recognition ( Hinton et al. , 2012 ) and bioinformatics ( Angermueller et al. , 2016 ) . Despite their increasing popularity , flexibility , generality , and performance , DNNs have been recently shown to be quite susceptible to small imperceptible input noise ( Szegedy et al. , 2014 ; Moosavi-Dezfooli et al. , 2016 ; Goodfellow et al. , 2015 ) . Such analysis gives a clear indication that even state-of-the-art DNNs may lack robustness . Consequently , there has been an ever-growing interest in the machine learning community to study this uncanny behaviour . In particular , the work of ( Goodfellow et al. , 2015 ; Moosavi-Dezfooli et al. , 2016 ) demonstrates that there are systematic approaches to constructing adversarial attacks that result in misclassification errors with high probability . Even more peculiarly , some noise perturbations seem to be doubly agnostic ( Moosavi-Dezfooli et al. , 2017 ) , i.e . there exist deterministic perturbations that can result in misclassification errors with high probability when applied to different networks , irrespective of the input ( denoted network and input agnostic ) . Understanding this degradation in performance under adversarial attacks is of tremendous importance , especially for real-world DNN deployment , e.g . self-driving cars/drones and equipment for the visually impaired . A standard and popular means to alleviate this nuisance is noisy data augmentation in training , i.e . a DNN is exposed to noisy input images during training so as to bolster its robustness during inference . Several works have demonstrated that DNNs can in fact benefit from such augmentation ( Moosavi-Dezfooli et al. , 2016 ; Goodfellow et al. , 2015 ) . However , data augmentation in general might not be sufficient for two reasons . ( 1 ) Particularly with high-dimensional input noise , the amount of data augmentation necessary to sufficiently capture the noise space will be very large , which will increase training time . ( 2 ) Data augmentation with high energy noise can negatively impact the performance on noise-free test examples . This can be explained by the fundamental trade-off between accuracy and robustness ( Tsipras et al. , 2018 ; Boopathy et al. , 2019 ) . It can also arise from the fact that augmentation forces the DNN to have the same prediction for two vastly different versions of the same input , noise-free and a substantially corrupted version . Therefore , in this paper , we propose a new regularizer for noise-robust networks to circumvent the aforementioned setbacks of data augmentation . A natural objective for training against attacks sampled from a distributionD , that bypasses the need for data augmentation , is the expected loss under this distribution . Since a closed-form expression is generally difficult to obtain or an approximate surrogate is expensive to evaluate ( Monte Carlo estimates ) , we propose instead a closely related objective that is the loss of the expected predictions of the network under D-distributed adversarial noise . Since it has been shown that Gaussian noise can be adversarial ( Bibi et al. , 2018 ) and that such noise is widely studied in applications such as image processing , we restrict the focus in this paper to the case whereD is Gaussian . While this may seem to be too restrictive , we later show that improving the robustness of networks against Gaussian attacks also improves the robustness against a family of other types of attacks . However , even under such an assumption , only a memory and computationally expensive ( expensive due to two-stage network linearization ) , closed-form approximate surrogate for network expected predictions exists ( Bibi et al. , 2018 ) . Contributions . ( i ) We formalize a new regularizer that is a function of the probabilistic first moment of the output of a DNN to train robust DNNs against noise sampled from distribution D. ( ii ) Under the special choice of Gaussian attacks , i.e . D is Gaussian , we show how the first moment expression can be evaluated very efficiently during training for an arbitrary deep DNN by bypassing the need to perform memory and computationally expensive two-stage linearization . ( iii ) Extensive experiments using LeNet ( LeCun et al. , 1999 ) and AlexNet ( Krizhevsky et al. , 2012 ) architectures on MNIST ( LeCun , 1998 ) , CIFAR10 , and CIFAR100 ( Krizhevsky & Hinton , 2009 ) datasets demonstrate that a substantial enhancement in robustness can be achieved when using our regularizer in training . In fact , in the majority of the experiments , the improvement is better than training on the same dataset , augmented with 3 to 21 times Gaussian noisy data . Interestingly , the results suggest an excellent trade-off between accuracy and robustness . Moreover , we show that networks that are trained to be robust against Gaussian attacks using our proposed regularizer enjoy orders of magnitude boost in robustness against a family of other types of attacks . 2 RELATED WORK . Despite the impressive performance of DNNs on various tasks , they have been shown to be very sensitive to certain types of noise , commonly referred to as adversarial examples , particularly in the recognition task ( Moosavi-Dezfooli et al. , 2016 ; Goodfellow et al. , 2015 ) . Adversarial examples can be viewed as small imperceptible noise that , once added to the input of a DNN , its performance is severely degraded . This finding has incited interest in studying/measuring the robustness of DNNs . The literature is rich with work that aims to unify and understand the notion of network robustness . For instance , Szegedy et al . ( 2014 ) suggested a spectral stability analysis for a wide class of DNNs by measuring the Lipschitz constant of the affine transformation describing a fully-connected or a convolutional layer . This result was extended to compute an upper bound for a composition of layers , i.e . a DNN . However , this measure sets an upper bound on the robustness over the entire input domain and does not take into account the noise distribution . Later , Fawzi et al . ( 2017a ) defined robustness as the mean support of the minimum adversarial perturbation , which is now the most common definition for robustness . Not only was robustness studied against adversarial perturbations but also against geometric transformations to the input . Fawzi et al . ( 2018 ) emphasized the independence of the robustness measure to the ground truth class labels and that it should only depend on the classifier and the dataset distribution . Subsequently , two different metrics to measure DNN robustness were proposed : one for general adversarial attacks and another for noise sampled from uniform distribution . Recently , Gilmer et al . ( 2018 ) showed the trade-off between robustness and test error from a theoretical point of view on a simple classification problem with hyperspheres . On the other hand , and based on various robustness analyses , several works proposed various approaches in building networks that are robust against noise sampled from well known distributions and against generic adversarial attacks . For instance , Grosse et al . ( 2017 ) proposed a model that was trained to classify adversarial examples with statistical hypothesis testing on the distribution of the dataset . Another approach is to perform statistical analysis on the latent feature space instead ( Li & Li , 2017 ; Feinman et al. , 2017 ) , or train a DNN that rejects adversarial attacks ( Lu et al. , 2017 ) . Moreover , the geometry of the decision boundaries of DNN classifiers was studied by Fawzi et al . ( 2017b ) to infer a simple curvature test for this purpose . Using this method , one can restore the orig- inal label and classify the input correctly . Restoring the original input using defense mechanisms , which can only detect adversarial examples , can be done by denoising ( ridding it from its adversarial nature ) so long as the noise perturbation is well-known and modeled apriori ( Zhu et al. , 2016 ) . A fresh approach to robustness was proposed by Zantedeschi et al . ( 2017 ) , where they showed that using bounded ReLUs ( if augmented with Gaussian noise ) to limit the output range can improve robustness . A different work proposed to distill the learned knowledge from a deep model to retrain a similar model architecture as a means to improving robustness ( Papernot et al. , 2016 ) . This training approach is one of many adversarial training strategies for robustness Makhzani et al . ( 2016 ) . More closely to our work is ( Cisse et al. , 2017 ) , where a new training regularizer was proposed for a large family of DNNs . The proposed regularizer softly enforces that the upper bound of the Lipshitz constant of the output of the network to be less than or equal to one . Moreover and very recently , the work of Bibi et al . ( 2018 ) has derived analytic expressions for the output mean and covariance of networks in the form of ( Affine , ReLU , Affine ) under a generic Gaussian input . This work also demonstrates how a ( memory and computation expensive ) two-stage linearization can be employed to locally approximate a deep network with a two layer one , thus enabling the application of the derived expressions on the approximated shallower network . Most prior work requires data augmentation , training new architectures that distill knowledge , or detect adversaries a priori , resulting in expensive training routines that may be ineffective in the presence of several input noise types . To this end , we address these limitations through our new regularizer that aims to fundamentally tackle Gaussian input noise without data augmentation and , as a consequence , improves overall robustness against other types of attacks . 3 METHODOLOGY . Background on Network Moments . Networks with a single hidden layer of the form ( Affine , ReLU , Affine ) can be written in the functional form g ( x ) = Bmax ( Ax + c1,0p ) +c2 . The max ( . ) is an element-wise operator , A ∈ Rp×n , and B ∈ Rd×p . Thus , g : Rn → Rd . Given that x ∼ N ( µx , Σx ) , Bibi et al . ( 2018 ) showed that : Theorem 1 The first moment of g ( x ) is E [ g ( x ) ] = B ( µ2 Φ ( µ2 σ2 ) + σ2 ϕ ( µ2 σ2 ) ) + c2 . Note that µ2 = Aµx + c1 , σ2 = √ diag ( Σ2 ) , Σ2 = AΣxA > , Φ and ϕ are the standard Gaussian cumulative ( CDF ) and density ( PDF ) functions , respectively . The vector multiplication and division are element-wise operations . Lastly , diag ( . ) extracts the diagonal elements of a matrix into a vector . For ease of notation , we let µ3 = T ( µ2 , σ2 ) = ( µ2 Φ ( µ2σ2 ) + σ2 ϕ ( µ2 σ2 ) ) . To extend the results of Theorem ( 1 ) to deeper models , a two-stage linearization was proposed in Bibi et al . ( 2018 ) , where ( A , B ) and ( c1 , c2 ) are taken to be the Jacobians and biases of the first order Taylor approximation to the two network functions around a ReLU layer in a DNN . Refer to Bibi et al . ( 2018 ) for more details about this expression and the proposed linearization . Proposed Robust Training Regularizer . To propose an alternative to noisy data augmentation to address its drawbacks , one has to realize that this augmentation strategy aims to minimize the expected training loss of a DNN when subjected to noisy input distribution D through sampling . In fact , it minimizes an empirical loss that approximates this expected loss when enough samples are present during training . When sampling is insufficient ( a drawback of data augmentation in highdimensions ) , this approximation is too loose and robustness can suffer . However , if we have access to an analytic expression for the expected loss , expensive data augmentation can be averted . This is the key motivation of the paper . Mathematically , the training loss can be modeled as min θ N∑ i=1 ( ` ( Φ ( xi ; θ ) , yi ) + α En∼D [ ` ( Φ ( xi + n ; θ ) , yi ) ] ) . ( 1 ) Here , Φ : Rn → Rd is any arbitrary network with parameters θ , ` is the loss function , { ( xi , yi ) } Ni=1 are the noise-free data-label training pairs , and α ≥ 0 is a trade off parameter . While the first term in Equation 1 is the standard empirical loss commonly used for training , the second term is often replaced with its Monte Carlo estimate through data augmentation . That is , for each training example xi , the second term is approximated with an empirical average of Ñ noisy examples of xi such that En∼D [ ` ( Φ ( xi + n ; θ ) , yi ) ] ≈ 1Ñ ∑Ñ j=1 ` ( Φ ( xi + nj ; θ ) , yi ) . This will increase the size of the dataset by a factor of Ñ , which will in turn increase training complexity . As discussed earlier , network performance on the noise-free examples can also be negatively impacted . Note that obtaining a closed form expression for the second term in Equation 1 for some of the popularly used losses ` is more complicated than deriving expressions for the output mean of the network Φ itself , e.g . in Theorem ( 1 ) . Therefore , we propose to replace this loss with the following surrogate min θ N∑ i=1 ( ` ( Φ ( xi ; θ ) , yi ) + α ` ( En∼D [ Φ ( xi + n ; θ ) ] , yi ) . ) ( 2 ) Because of Jensen ’ s inequality , Equation 2 is a lower bound to Eq Equation 1 when ` is convex , which is the case for most popular losses including ` 2-loss and cross-entropy loss . The proposed second term in Equation 2 encourages that the output mean of the network Φ of every noisy example ( xi + n ) matches the correct class label yi . This regularizer will stimulate a separation among the output mean of the classes if the training data is subjected to noise sampled fromD . Having access to an analytic expression for these means will prompt a simple inexpensive training , where the actual size of the training set is unaffected and augmentation is avoided . This form of regularization is proposed to replace data augmentation . While a closed-form expression for the second term of Equation 2 might be infeasible for a general network Φ ( . ) , an expensive approximation can be attained . In particular , Theorem Equation 1 provides an analytic expression to evaluate the second term in Equation 2 , for when D is Gaussian and when the network is approximated by a two-stage linearization procedure as Φ ( x ) ≈ Bmax ( Ax + c1,0p ) +c2 . However , it is not clear how to utilize such a result to regularize networks during training with Equation 2 as a loss . This is primarily due to the computationally expensive and memory intensive network linearization proposed in Bibi et al . ( 2018 ) . Specifically , the linearization parameters ( A , B , c1 , c2 ) are a function of the network parameters , θ , which are updated with every gradient descent step on Equation 2 ; thus , two-stage linearization has to be performed in every θ update step , which is infeasible . On an Efficient Approximation to Equation 2 . The loss in Equation 2 proposes a generic approach to train robust arbitrary networks against noise sampled from an arbitrary distribution D. Since the problem in its general setting is too broad for detailed analysis , we restrict the scope of this work to the class of networks , which are most popularly used and parameterized by θ , Φ ( . ; θ ) : Rn → Rd with ReLUs as nonlinear activations . Moreover , since random Gaussian noise was shown to exhibit an adversarial nature Bibi et al . ( 2018 ) ; Rauber et al . ( 2017 ) ; Franceschi et al . ( 2018 ) , and it is one of the most well studied noise models for the useful properties it exhibits , we restrict D to the case of Gaussian noise . In particular , D is independent zero-mean Gaussian noise at the input , i.e . n ∼ D = N ( 0 , Σx = Diag ( σ2x ) ) , where σ2x ∈ Rn is a vector of variances and Diag ( . ) reshapes the vector elements into a diagonal matrix . Generally , it is still difficult to compute the second term in Equation 2 under Gaussian noise for arbitrary networks . However , if we have access to an inexpensive approximation of the network , avoiding the computationally and memory expensive network linearization in Bibi et al . ( 2018 ) , an approximation to the second term in Equation 2 can be used for efficient robust training directly on θ . Consider the lth ReLU layer in Φ ( . ; θ ) . the network can be expressed as Φ ( . ; θ ) = Ω ( ReLUl ( Υ ( . , θ1 ) ) ; θ2 ) . Note that the parameters of the overall network Φ ( . ; θ ) is the union of the parameters of the two subnetworks Υ ( . ; θ1 ) and Ω ( . ; θ2 ) , i.e . θ = θ1∪θ2 . Throughout this work and to simplify the analysis , we set l = 1 . With such a choice of l , the first subnetwork Υ ( . , θ1 ) is affine with θ1 = { A , c1 } . However , the second subnetwork Ω ( . , θ2 ) is not linear in general , and thus , one can linearize Ω ( . , θ2 ) at En∼N ( 0 , Σx ) [ ReLU1 ( Υ ( xi + n ; θ1 ) ) ] = T ( µ2 , σ2 ) = µ3 . Note that µ3 is the output mean after the ReLU and µ2 = Axi + c1 , since Υ ( xi + n ; θ1 ) = A ( xi + n ) + c1 . Both T ( . , . ) and σ2 are defined in Equation 1 . Thus , linearizing Ω at µ3 with linearization parameters ( B , c2 ) being the Jacobian of Ω and c2 = Ω ( µ3 , θ2 ) − Bµ3 , we have that , for any point vi close to µ3 : Ω ( vi , θ2 ) ≈ Bvi + c2 . While computing ( B , c2 ) through linearization is generally very expensive , computing the approximation to Equation 2 requires explicit access to neither B nor c2 . Note that this second term for l = 1 is given as : ` ( En∼N ( 0 , Σx ) [ Φ ( xi + n ; θ ) ] , yi ) = ` ( Ezi∼N ( xi , Σx ) [ Ω ( ReLU1 ( Υ ( zi ; θ1 ) ) ; θ2 ) ] , yi ) = ` ( Ezi∼N ( xi , Σx ) [ Ω ( ReLU1 ( Azi + c1 ) ; θ2 ) ] , yi ) ≈ ` ( Ezi∼N ( xi , Σx ) [ B ( ReLU1 ( Azi + c1 ) ) + c2 ] , yi ) = ` ( Bµ3 + c2 , yi ) = ` ( Ω ( µ3 , θ2 ) , yi ) . ( 3 ) The approximation follows from the assumption that the input to the second subnetwork Ω ( . ; θ2 ) , i.e . vi = ReLU1 ( Azi + c1 ) ) , is close to the point of linearization µ3 such that Ω ( vi ; θ2 ) ≈ Bvi + c2 . Or simply , that the input to Ω is close to the mean inputs , i.e . µ3 , to Ω under Gaussian noise . The penultimate equality follows from the linearity of the expectation . As for the last equality , ( B , c2 ) are the linearization parameters of Ω at µ3 , where c2 = Ω ( µ3 , θ2 ) − Bµ3 by the first order Taylor approximation . Thus , computing the second term of Equation 2 according to Equation 3 can be simply approximated by a forward pass of µ3 through the second network Ω . As for computing µ3 = T ( µ2 , σ2 ) , note that µ2 = Axi + c1 in Equation 3 , which is equivalent to a forward pass of xi through the first subnetwork because Υ ( . , θ1 ) is linear with θ1 = { A , c1 } . Moreover , since σ2 =√ diag ( AΣxA > ) , we have : σ2 = √ diag ( ADiag ( σ2x ) A > ) = √ ( A A ) σ2x . The expression for σ2 can be efficiently computed by simply squaring the linear parameters in the first subnetwork and performing a forward pass of the input noise variance σ2x through Υ without the bias c1 and taking the element-wise square root . Lastly , it is straightforward to compute T ( µ2 , σ2 ) as it is an elementwise function in Equation 1 . The overall computational graph in Figure 1 shows a summary of the computation needed to evaluate the loss in Equation 2 using only forward passes through the two subnetworks Υ and Ω . It is now possible with the proposed efficient approximation of our proposed regularizer in Equation 2 to efficiently train networks on noisy training examples that are corrupted with noise N ( 0 , Σx ) without any form of prohibitive data augmentation .

Summary: This paper proposes a regularization method for achieving robustness to noisy inputs, with relatively less computation compared to standard data augmentation approaches. Specifically, the authors analyze the analytic expression of the loss on the noisy inputs, and using Jensen’s inequality, propose to minimize a surrogate loss over the expectation of noisy inputs. To minimize the loss over the expectation, the authors impose a regularization over the first moment of the network weights. The authors validate the model with the proposed regularization technique for its robustness against Gaussian attack and other types of attacks, whose results show that the model is robust.