Improved robustness to adversarial examples using Lipschitz regularization of the loss

1 INTRODUCTION . We augment adversarial training ( AT ) with worst case adversarial training ( WCAT ) which improves adversarial robustness by 11 % over the current state-of-the-art result ( Qian & Wegman , 2018 ) in the ` 2 norm . The method also achieves results comparable to the state-of-the-art results of Madry et al . ( 2017 ) in the ` ∞ norm . Moreover , our adversarial training step uses only one gradient evaluation compared to seven steps in the Madry et al . ( 2017 ) work . The worst case adversarial training method is described as follows . During adversarial training , the gradient of the loss is computed for each perturbed image . WCAT records the largest of the gradients norms , and adds a penalty to the loss proportional to this term . In many cases we observe that models trained with AT and WCAT have improved test/validation error over the unregularized model . In §2 we show that the norm of the gradient of the loss of the model is a measure of the robustness of a model to adversarial examples . We obtain verifiable worst and average case robustness guarantees , based on the expected and maximum values of the norm of the gradient of the loss . We then compute these quantities empirically on trained models , and demonstrate that improving these quantities leads to proportional improvements in adversarial robustness . In §3 we interpret adversarial training as Total Variation ( TV ) Regularization , which is a fundamental tool in mathematical image processing . TV regularization was introduced for image denoising ( Rudin et al. , 1992 ) . It is a measure of the variation of a function , allowing for discontinuities . We also show that WCAT corresponds to Lipschitz regularization , which appears in Image Inpainting ( Bertalmio et al. , 2000 ) and function approximation ( Crandall et al. , 2001 ; Oberman , 2005 ) . Lipschitz regularization was used in a recent proof of generalization of deep neural networks ( Oberman & Calder , 2018 ) . Write ` ( x ) = ` ◦ f ( x ) for the loss of the model . We show that training with AT and WCAT is equivalent to minimizing J [ ` ] = E ( x , y ) ∼D [ ` ( x ) ] ︸ ︷︷ ︸ expected loss + E ( x , y ) ∼D [ ‖∇x ` ( x ) ‖∗ ] ︸ ︷︷ ︸ AT = TV regularization +λ max ( x , y ) ∈D ‖∇x ` ( x ) ‖∗︸ ︷︷ ︸ WCAT = Lipschitz regularization ( 1 ) where is the size of the adversarial training perturbation , and λ is the WCAT multiplier . The dual norm ‖ · ‖∗ corresponds to ‖ · ‖1 for attacks measured in ` ∞ and to ‖ · ‖2 for attacks measured in ` 2,1 see §3.1 . 1.1 ADVERSARIAL ATTACKS AND ADVERSARIAL TRAINING . The earliest and most successful defense is adversarial training ( Szegedy et al . ( 2013 ) ; Goodfellow et al . ( 2014 ) ; Tramèr et al . ( 2018 ) ; Madry et al . ( 2017 ) ) . Top entries in a recent adversarial defence 1We overload ‘ ` ’ as notation for both the loss and for norms : the meaning should be clear from the context . competition ( Kurakin et al . ( 2017 ) ) used Ensemble Adversarial Training ( Tramèr et al . ( 2018 ) ) , where a model is adversarially trained with inputs generated by an ensemble of other models . For more background , refer to the recent review Goodfellow et al . ( 2018 ) which discusses defences against adversarial attacks and their limitations . Adversarial attacks seek to find the minimum norm vector which leads to a misclassification by the model . Finding the optimal attack is intractable ( Athalye et al. , 2018 ) . An alternative which permits loss gradients to be used is to consider the attack vector measured in a given norm which most increases the loss , max‖a‖≤ε ` ( x+ a ) . Adversarial training improves robustness to adversarial attacks by solving the minimax problem min w E ( x , y ) ∼D [ max ‖δ‖≤ε ` ( f ( x+ δ ; w ) , y ) ] In practice , a tractable attack vector , a ( x ) , is used , in place of the optimal δ , leading to E ( x , y ) ∼D [ ` ( x+ a ( x ) ) ] . 2 ROBUSTNESS GUARANTEES FROM THE LIPSCHITZ CONSTANT . Weng et al . ( 2018 ) and Hein & Andriushchenko ( 2017 ) showed that the Lipschitz constant of the model can be used to establish rigorous worst-case bounds on adversarial robustness . In particular Weng et al . ( 2018 ) show that the Lipschitz constant of the model gives a certifiable minimum adversarial distance : a successful attack on image x will have adversarial distance at least δ ≥ min j 6=i∗ fi∗ ( x ) − fj ( x ) 2Lf ( 2 ) where Lf is the Lipschitz constant of the model , f , and i∗ is the correct label of x . Thus training models to have small Lipschitz constant should improve adversarial robustness ( Hein & Andriushchenko ( 2017 ) ; Tsuzuku et al . ( 2018 ) ) . Remark 2.1 ( Application of empirical Lipschitz constants ) . In theory , it is possible to extend the data with a function whose Lipschitz constant matches that of the data see §C for more details . We argue that a model whose Lipschitz constant better approximates the Lipschitz constant of the data brings us closer to the ground truth . Lipschitz regularization brings the ( estimated ) Lipschitz constant of a model close to the Lipschitz constant of the data on which it was trained . For example on CIFAR-10 , the Lipschitz constant for the dataset is 0.36 . For a regularized model ( ResNeXt-34 , see §5 ) the estimated Lipschitz constant was 1.32 , but was 13.70 for an undefended model ( the latter two measured on the test/validation set ) . 2.1 ADVERSARIAL ROBUSTNESS BASED ON GRADIENTS OF MODEL LOSS . Here we obtain adversarial robustness bounds based on the gradient of the loss of the model . The second and third terms in ( 1 ) estimate the average and worst case robustness . The first part of the following result is the analogue of ( 2 ) , with the model loss instead of the model ( which is a scalar instead of a vector ) . The second part of the result gives an average case robustness bound . Lemma 2.2 ( Worst-case and expected stability ) . Write ` ( x ) = ` ◦ f ( x ) for the loss of the model . Let a be any adversarial perturbation of norm ‖a ( x ) ‖ ≤ ε . If ` ( x ) is L-Lipschitz continuous then ` ( x+ a ) ≤ ` ( x ) + Lε ( 3 ) In addition , if TV ( ` ) = E ( x , y ) ∼D ‖∇ ` ( x ) ‖∗ ≤ R then E ( x , y ) ∼D [ ` ( x+ a ) ] ≤ E ( x , y ) ∼D [ ` ( x ) ] +Rε+O ( ε2 ) ( 4 ) The proof is in §B.1 Remark 2.3 ( Application of robustness guarantees ) . One possible use of the result is that we can estimate adversarial robustness on unseen data drawn from the same distribution using the values of the terms corresponding to AT and WCAT in ( 1 ) For example , we estimated the values of the terms corresponding to AT and WCAT in ( 1 ) for a regularized model trained with ( 1 ) and for an undefended model . We expect the ratio of these values between the models to be an effective predictor of the relative robustness of each model . The regularized model had better values of AT and WCAT by factors of 3.3 , and 9 , respectively . The median adversarial distance of the regularized model was better by a factor of 5 , which lies between those factors . See §5 for more empirical results . 3 REGULARIZATION INTERPRETATION OF AT AND WCAT . 3.1 ADVERSARIAL TRAINING CORRESPONDS TO TV REGULARIZATION . The next result interprets adversarial training using either the one-step Signed Gradient attack vector ( Goodfellow et al. , 2018 ) or the gradient attack vector as Total Variation regularization . Lemma 3.1 . Adversarial training using the ε-scaled one step attack vector is equivalent up to terms of order ε2 to augmenting the loss with Total Variation regularization , J [ ` ] = E ( x , y ) ∼D [ ` ( x ) + ε‖∇ ` ( x ) ‖∗ ] where the ‖ · ‖∗ is the dual norm to the norm measuring adversarial perturbations . The proof is in §B.2 . 3.2 WORST CASE AT CORRESPONDS TO LIPSCHITZ REGULARIZATION . The basis for this result is Rademacher ’ s Theorem ( Evans , 2018 , §3.1 ) , which states that if a function g ( x ) is Lipschitz continuous then it is differentiable almost everywhere and Lip ( g ) = max x ‖∇g ( x ) ‖ We obtain an underestimate of Lip ( g ) by sampling the norm of the gradient on a subset of points . Definition 3.2 ( Method for estimating the Lipschitz constant ) . Let ` be a Lipschitz continuous function . Then max x∈D ‖∇ ` ( x ) ‖ ≤ Lip ( ` ) ( 5 ) During training , we apply ( 5 ) to ` ( x ) and set D to be a mini-batch to obtain the WCAT term in ( 1 ) . When we estimate the Lipschitz constant of a trained model , we use the full test/validation dataset . Remark 3.3 . Regularization of the loss corresponds to partially regularizing the model , but at a much lower cost . Since the loss is a scalar , regularizing by the Lipschitz constant of the loss is equivalent to regularization of the model f in one direction . By the chain rule , ∇x ` ( f ( x ) , y ) = ∇f ` ( f ( x ) , y ) ∇x f ( x ) For example , when ` is the KL divergence , and when f = softmax ( z ( x ) ) then ∇x ` ( f ( x ) , y ) = ( f ( x ) − y ) ) ∇x z ( x ) Thus , in this case , regularizing ` ( x ) corresponds to regularization of z ( x ) in the direction f ( x ) − y . 4 IMPLEMENTATION OF THE LIPSCHITZ CONSTANT OF A NETWORK . Data independent upper bounds on the Lipschitz constant of the model go back to Bartlett ( 1996 ) . These bounds are based on the product of the norm of the weight matrices , and neglect the effects of the activation function . We summarize this upper bound as follows . Let W k be the weight matrix of the k-th layer of a network f comprised of N layers , and suppose all non linearities of a network are at most 1-Lipschitz . Then Lipp , q ( f ) ≤ N∏ k=1 ‖W k‖pk , pk−1 ( 6 ) with p0 = p and pn = q . Certain conditions on the pk ’ s must be met . For a proof with p , q = 2 see Tsuzuku et al . ( 2018 ) . Recent works based on this estimate include : Cissé et al . ( 2017 ) , using the distance to the nearest orthonormal matrix ; Miyato et al . ( 2018 ) , using the 2-norm ; Gouk et al . ( 2018 ) , using either the 1-norm or∞-norm ; and Qian & Wegman ( 2018 ) , using the∞-norm . In these works , the estimate is used to penalize the Lipschitz constant of the model during training , and so the the logarithm of the estimate is used . Of these four papers , only the implementation of Gouk et al . accounts for batch normalization . Since batch normalization multiplies each weight matrix by a diagonal scaling matrix , the other works are missing important terms in their implementations . A different method for estimating the Lipschitz constant of a pre-trained model was presented in Weng et al . ( 2018 ) , using statistical techniques from extreme value theory . This estimate accurately captures the minimum adversarial distance needed to successfully misclassify an image . However it requires at a minimum many tens of model evaluations for each image , and so is not tractable as a Lipschitz penalty during training .

Summary: This paper explores augmenting the training loss with an additional gradient regularization term to improve the robustness of models against adversarial examples. The authors show that this training loss can be interpreted as a form of adversarial training against optimal L2 and L_infinity adversarial perturbations. This augmented training effectively reduces the Lipschitz constant of the network, leading to improved robustness against a wide variety of attack algorithms.