Efficient Robust Training via Backward Smoothing

1 INTRODUCTION . Deep neural networks are well known to be vulnerable to adversarial examples ( Szegedy et al. , 2013 ) , i.e. , a small perturbation on the original input can lead to misclassification or erroneous prediction . Many defense methods have been developed to mitigate the disturbance of adversarial examples ( Guo et al. , 2018 ; Xie et al. , 2018 ; Song et al. , 2018 ; Ma et al. , 2018 ; Samangouei et al. , 2018 ; Dhillon et al. , 2018 ; Madry et al. , 2018 ; Zhang et al. , 2019 ) , among which robust training methods , such as adversarial training ( Madry et al. , 2018 ) and TRADES ( Zhang et al. , 2019 ) , are currently the most effective strategies . Specifically , adversarial training method ( Madry et al. , 2018 ) trains a model on adversarial examples by solving a min-max optimization problem : min θ 1 n n∑ i=1 max x′i∈B ( xi ) L ( fθ ( x ′ i ) , yi ) , ( 1.1 ) where { ( xi , yi ) } ni=1 is the training dataset , f ( · ) denotes the logits output of the neural network , B ( xi ) : = { x : ‖x− xi‖∞ ≤ } denotes the -perturbation ball , and L is the cross-entropy loss . On the other hand , instead of directly training on adversarial examples , TRADES ( Zhang et al. , 2019 ) further improves model robustness with a trade-off between natural accuracy and robust accuracy , by solving the empirical risk minimization problem with a robust regularization term : min θ 1 n n∑ i=1 [ L ( fθ ( xi ) , yi ) + β max x′i∈B ( xi ) KL ( s ( fθ ( xi ) ) , s ( fθ ( x ′ i ) ) ) ] , ( 1.2 ) where s ( · ) denotes the softmax function , and β > 0 is a regularization parameter . The goal of this robust regularization term ( i.e. , KL divergence term ) is to ensure the outputs are stable within the local neighborhood . Both adversarial training and TRADES achieve good model robustness , as shown on recent model robustness leaderboards1 ( Croce & Hein , 2020b ; Chen & Gu , 2020 ) . 1https : //github.com/fra31/auto-attack and https : //github.com/uclaml/RayS . However , a major drawback lies in that both are highly time-consuming for training , limiting their usefulness in practice . This is largely due to the fact that both methods perform iterative adversarial attacks ( i.e. , Projected Gradient Descent ) to solve the inner maximization problem in each outer minimization step . Recently , Wong et al . ( 2020 ) shows that it is possible to use single-step adversarial attacks to solve the inner maximization problem , which previously was believed impossible . The key ingredient in their approach is adding a random initialization step before the single-step adversarial attack . This simple change leads to a reasonably robust model that outperforms other fast robust training techniques , e.g. , Shafahi et al . ( 2019 ) . However , it remains a mystery why random initialization is empirically effective . Furthermore , compared to state-of-the-art robust training models ( Madry et al. , 2018 ; Zhang et al. , 2019 ) , this approach still lags behind on model robustness . In this work , we aim to understand the role of random initialization , as well as closing the robustness gap between adversarial training and Fast Adversarial Training ( Fast AT ) ( Wong et al. , 2020 ) . We propose a new principle towards understanding Fast AT - that random initialization can be viewed as performing randomized smoothing for better optimization of the inner maximization problem . We demonstrate that the smoothing effect by random initialization is not sufficient under the adversarial perturbation constraint . By proposing a new initialization strategy , backward smoothing , which strengthens the smoothing effect within the -perturbation ball , we present a new fast robust training method based on TRADES ( Zhang et al. , 2019 ) . The resulting method significantly improves both stability and model robustness over the single-step version of TRADES ( Zhang et al. , 2019 ) , while consuming much less training time ( ∼ 3x improvement with the same training schedule ) . 2 RELATED WORK . There exists a large body of work on adversarial attacks and defenses . In this section , we only review the most relevant work to ours . Adversarial Attack The concept of adversarial examples was first proposed in Szegedy et al . ( 2013 ) . Since then , many methods have been proposed , such as Fast Gradient Sign Method ( FGSM ) ( Goodfellow et al. , 2015 ) , and Projected Gradient Descent ( PGD ) ( Kurakin et al. , 2016 ; Madry et al. , 2018 ) . Later on , various attacks ( Papernot et al. , 2016 ; Moosavi-Dezfooli et al. , 2016 ; Carlini & Wagner , 2017 ; Athalye et al. , 2018 ; Chen et al. , 2020 ; Croce & Hein , 2020a ) were also proposed for better effectiveness or efficiency . There are also many attacks focused on different attack settings . Chen et al . ( 2017 ) proposed a black-box attack where the gradient is not available , by estimating the gradient via finite-differences . Various methods ( Ilyas et al. , 2018 ; Al-Dujaili & O ’ Reilly , 2020 ; Moon et al. , 2019 ; Andriushchenko et al. , 2019 ; Tashiro et al. , 2020 ) have been developed to improve the query efficiency of Chen et al . ( 2017 ) . Other methods ( Brendel et al. , 2018 ; Cheng et al. , 2019 ; 2020 ) focused on the more challenging hard-label attack setting , where only the prediction labels are available . On the other hand , there is recent work ( Croce & Hein , 2020b ; Chen & Gu , 2020 ) that aims to accurately evaluate the model robustness via ensemble of attacks or effective hard-label attack . Robust Training Many heuristic defenses ( Guo et al. , 2018 ; Xie et al. , 2018 ; Song et al. , 2018 ; Ma et al. , 2018 ; Samangouei et al. , 2018 ; Dhillon et al. , 2018 ) were proposed when the concept of adversarial examples was first introduced . However , they are later shown by Athalye et al . ( 2018 ) as not truly robust . Adversarial training ( Madry et al. , 2018 ) is the first effective method towards defending against adversarial examples . In Wang et al . ( 2019 ) , a new convergence quality criterion was proposed . Zhang et al . ( 2019 ) showed the trade-off between natural accuracy and robust accuracy . Wang et al . ( 2020 ) proposed to improve model robustness by better utilizing misclassified examples . Another line of research utilizes extra information ( e.g. , pre-trained models ( Hendrycks et al. , 2019 ) or extra unlabeled data ( Carmon et al. , 2019 ; Alayrac et al. , 2019 ) ) to further improve robustness . Other work focuses on improving training efficiency , such as free adversarial training from Shafahi et al . ( 2019 ) and Fast AT from Wong et al . ( 2020 ) using single-step attack ( FGSM ) with random initialization . Li et al . ( 2020 ) proposed a hybrid approach for improving Fast AT which is orthogonal to ours . Andriushchenko & Flammarion ( 2020 ) proposed a new regularizer promoting gradient alignment . Yet , it is not focused on closing the robustness gap with state-of-the-arts . Randomized Smoothing Duchi et al . ( 2012 ) proposed the randomized smoothing technique and proved variance-based convergence rates for non-smooth optimization . Later on , this technique was applied to certified adversarial defenses ( Cohen et al. , 2019 ; Salman et al. , 2019 ) for building robust models with certified robustness guarantees . In this paper , we are not targeting certified defenses . Instead , we use the randomized smoothing concept in optimization to explain Fast AT . 3 WHY RANDOM INITIALIZATION HELPS ? . We aim to explain why random initialization in Fast AT is effective , and propose a new understanding that random initialization can be viewed as performing randomized smoothing on the inner maximization problem in adversarial training ( Madry et al. , 2018 ) . Below , we first introduce the randomized smoothing technique ( Duchi et al. , 2012 ) in optimization . It is well known from optimization theory ( Boyd et al. , 2004 ) that non-smooth objectives are generally harder to optimize compared with smooth objectives . In general , a smoother loss function allows us to use a larger step size while guaranteeing the convergence of gradient-based algorithms . Randomized smoothing technique ( Duchi et al. , 2012 ) was proposed based on the observation that random perturbation of the optimization variable can be used to transform the loss into a smoother one . Instead of using only the gradient at the original iterate , randomized smoothing proposes to randomly generate perturbed iterates and use their gradients for optimization procedure . More details are provided in Appendix A . Let us recall the inner maximization problem in adversarial training : max δ∈B ( 0 ) L ( fθ ( x+ δ ) , y ) . ( 3.1 ) Here , fθ denotes a neural network parameterized by θ . In general , neural networks are non-smooth due to ReLU activations and pooling layers . This suggests that ( 3.1 ) can be difficult to solve , and using gradient descent with large step size can lead to divergence in the maximization problem . It also explains why directly using single-step projected gradient ascent without random initialization fails ( Wong et al. , 2020 ) . Now , let us apply randomized smoothing to ( 3.1 ) : max δ∈B ( 0 ) Eξ∼U ( −1,1 ) L ( fθ ( x+ δ + ξ ) , y ) , ( 3.2 ) where ξ is the perturbation vector for randomized smoothing , and δ is the perturbation vector for later gradient update step ( initialized as zero ) . Suppose we solve ( 3.2 ) in a stochastic fashion ( i.e. , sample a random perturbation ξ instead of computing the expectation over ξ ) , and using only one step gradient update . We can see that this reduces to the Fast AT formulation . This suggests that Fast AT can be viewed as performing stochastic single-step attacks on a randomized smoothed objective function which allows using larger step size . This explains why random initialization helps Fast AT as it makes the loss objective smoother and thus easier to optimize . It is worth noting that Andriushchenko & Flammarion ( 2020 ) also provided an explanation of why Fast Adversarial Training works : random initialization reduces the magnitude of the perturbation and thus the network becomes more linear and fits better toward single-step attack . While we argue that the random initialization works as randomized smoothing for smoothing the inner maximization problem and makes it easier to solve . In fact , our argument is more general and can cover theirs , because if the loss function is approximately linear , then it will be very smooth , i.e. , the second-order term in the Taylor expansion is very small . 4 PROPOSED APPROACH . 4.1 DRAWBACKS OF THE RANDOM INITIALIZATION STRATEGY . Although Fast AT achieves much faster robust training compared with standard adversarial training ( Madry et al. , 2018 ) , it exposes several major weaknesses . For demonstration , we exclude the additional acceleration techniques introduced in Wong et al . ( 2020 ) for accelerating the training speed ( e.g. , mix-precision training , cyclic learning rate ) , and instead apply standard piecewise learning rate decay used in Madry et al . ( 2018 ) ; Zhang et al . ( 2019 ) with the decay point set at the 50-th and 75-th epochs . Performance Stability As observed in Li et al . ( 2020 ) , Fast AT can be highly unstable ( i.e. , large variance in robust performance ) when using traditional piecewise learning rate decay schedule . We argue that this is because Wong et al . ( 2020 ) utilized a drastically large attack step size ( 10/255 , even larger than the perturbation limit ) , which causes unstable training behavior . To validate this , we run Fast AT on CIFAR-10 using ResNet-18 model ( He et al. , 2016 ) for 10 times with different step sizes . Note that we adopt early-stopping and record the best-performing model among 100 epochs . As shown in Figure 1 , although the single-best robustness performance is obtained by using step size 10/255 , the variance is very high . Moreover , most trials lead to weak robust performance with a low average and median robust accuracy . On the other hand , we observe that when using step size 8/255 , model robustness is more stable and higher on average . Note that using a too small step size would by nature hurt model robustness . These observations suggest that Fast AT can not achieve the best performance on robust performance and stability simultaneously . Potential for Robustness Improvement Fast AT uses standard adversarial training ( Madry et al. , 2018 ) as the baseline , and can obtain similar robustness performance . However , later work ( Rice et al. , 2020 ) shows that adversarial training can cause the overfitting problem , while early stopping can largely improve robustness . Zhang et al . ( 2019 ) further achieves even better model robustness that is much higher than what Fast AT obtains . From Table 1 , we observe that there exists an 8 % robust accuracy gap between Fast AT ( average over 10 runs ) and the best-performing TRADES model . Even for the best out of 10 trials , there is still a 6 % gap . This indicates that Fast AT is still far from optimal , and there is still big room for further robustness improvement .

Summary: The paper proposes Backward Smoothing to close the gap in terms of robustness between standard multi-step and fast (one or two steps) adversarial training (AT). In particular, at high level, given a network $f$, a point $x$ and its logits $f(x)$ it suggests to first sample a random perturbation $\psi$ in the logits space around $f(x)$ and second computing, via one step of gradient descent, $\xi^*$ so to minimize the KL-divergence between the softmax values of $f(x) + \psi$ and $f(x + \xi^*)$. Then $x + \xi^*$ is used as starting point for one-step AT. The rationale behind the scheme is that the random step commonly added to $x$ before AT might be not sufficient to achieve a smoothing effect on the loss function and then an effective optimization.