Improving Hierarchical Adversarial Robustness of Deep Neural Networks

1 INTRODUCTION . Deep neural networks ( DNNs ) are highly vulnerable to attacks based on small modification of the input to the network at test time ( Szegedy et al. , 2013 ) . Those adversarial perturbations are carefully crafted in a way that they are imperceptible to human observers , but when added to clean images , can severely degrade the accuracy of the neural network classifier . Since their discovery , there has been a vast literature proposing various attack and defence techniques for the adversarial settings ( Szegedy et al. , 2013 ; Goodfellow et al. , 2014 ; Kurakin et al. , 2016 ; Madry et al. , 2017 ; Wong et al. , 2020 ) . These methods constitute important first steps in studying adversarial robustness of neural networks . However , there exists a fundamental flaw in the way we assess a defence or an attack mechanism . That is , we overly generalize the mistakes caused by attacks . Particularly , the current approaches focuses on the scenario where different mistakes caused by the attacks are treated equally . We argue that some context do not allow mistakes to be considered equal . In CIFAR-100 ( Krizhevsky et al. , 2009 ) , it is less problematic to misclassify a pine tree as a oak tree than a fish as a truck . As such , we are motivated to propose the concept of hierarchical adversarial robustness to capture this notion . Given a dataset whose classes can be grouped into coarse labels , we define hierarchical adversarial examples as the ones leading to a misclassification at the coarse level ; and we present a variant of the projected gradient descent ( PGD ) adversaries ( Madry et al. , 2017 ) to find hierarchical adversarial examples . Finally , we introduce a simple and principled hierarchical adversarially robust ( HAR ) network which decompose the end-to-end robust learning task into a single classification task into one coarse and multiple fine classification tasks , before being trained by adversarial defence techniques . Our contribution are • We introduce the concept of hierarchical adversarial examples : a special case of the standard adversarial examples which causes mistakes at the coarse level ( Section 2 ) . • We present a worst-case targeted PGD attack to find hierarchical adversarial examples . The attack iterates through all candidate fine labels until a successful misclassification into the desired target ( Section 2.1 ) . • We propose a novel architectural approach , HAR network , for improving the hierarchical ad- versarial robustness of deep neural networks ( Section 3 ) . We empirically show that HAR networks significantly improve the hierarchical adversarial robustness against ` ∞ attacks ( = 8255 ) ( Section 4 ) and ` 2 attacks ( = 0.5 ) ( Appendix A.4 ) on CIFAR-100 . • We benchmark using untargeted PGD20 attacks as well as the proposed iterative targeted PGD attack . In particular , we include an extensive empirical study on the improved hierarchical robustness of HAR by evaluating against attacks with varying PGD iterations and . We find that a vast majority of the misclassifications from the untargeted attack are within the same coarse label , resulting a failed hierarchical attack . The proposed iterative targeted attacks provides a better empirical representation of the hierarchical adversarial robustness of the model ( Section 4.2 ) . • We show that the iterative targeted attack formulated based on the coarse network are weaker hierarchical adversarial examples compared to the ones generated using the entire HAR network ( Section 4.3 ) . 2 HIERARCHICAL ADVERSARIAL EXAMPLES . The advancement in DNN image classifiers is accompanied by the increasing complexity of the network design ( Szegedy et al. , 2016 ; He et al. , 2016 ) , and those intricate networks has provided state-of-the-art results on many benchmark tasks ( Deng et al. , 2009 ; Geiger et al. , 2013 ; Cordts et al. , 2016 ; Everingham et al. , 2015 ) . Unfortunately , the discovery of adversarial examples has revealed that neural networks are extremely vulnerable to maliciously perturbed inputs at test time ( Szegedy et al. , 2013 ) . This makes it difficult to apply DNN-based techniques in mission-critical and safetycritical areas . Another important develeopment along with the advancement of DNN is the growing complexity of the dataset , both in size and in number of classes : i.e . from the 10-class MNIST dataset to the 1000-class ImageNet dataset . As the complexity of the dataset increases exponentially , dataset can often be divided into several coarse classes where each coarse class consists of multiple fine classes . In this paper , we use the term label and class interchangeably . The concept of which an input image is first classified into coarse labels and then into fine labels are referred to as hierarchical classification ( Tousch et al. , 2012 ) . Intuitively , the visual separability between groups of fine labels can be highly uneven within a given dataset , and thus some coarse labels are more difficult to distinguish than others . This motivates the use of more dedicated classifiers for specific groups of classes , allowing the coarse labels to provide information on similarities between the fine labels at an intermediate stage . The class hierarchy can be formed in different ways , and it can be learned strategically for optimal performance of the downstream task ( Deng et al. , 2011 ) . Note that it is also a valid strategy to create a customized class hierarchy and thus be able to deal with sensitive missclassification . To illustrate our work , we use the predefined class hierarchy of the CIFAR-10 and the CIFAR-100 dataset ( Krizhevsky et al. , 2009 ) : fine labels are grouped into coarse labels by semantic similarities . All prior work on adversarial examples for neural networks , regardless of defences or attacks , focuses on the scenario where all misclassifications are considered equally ( Szegedy et al. , 2013 ; Goodfellow et al. , 2014 ; Kurakin et al. , 2016 ; Madry et al. , 2017 ; Wong et al. , 2020 ) . However , in practice , this notion overly generalizes the damage caused by different types of attacks . For example , in an autonomous driving system , confusing a perturbed image of a traffic sign as a pedestrian should not be treated the same way as confusing a bus as a pickup truck . The former raises a major security threat for practical machine learning applications , whereas the latter has very little impact to the underlying task . Moreover , misclassification across different coarse labels poses potential ethical concerns when the dataset involves sensitive features such as different ethnicities , genders , people with disabilities and age groups . Mistakes across coarse classes leads to much more severe consequences compared to mistakes within coarse classes . As such , to capture this different notion of attacks , we propose the term hierarchical adversarial examples . They are a specific case of adversarial examples where the resulting misclassification occurs between fine labels that come from different coarse labels . Here , we provide a clear definition of the hierarchical adversarial examples to differentiate it from the standard adversarial examples . We begin with the notation for the classifier . Consider a neural network F ( x ) : Rd → Rc with a softmax as its last layer ( Hastie et al. , 2009 ) , where d and c denote the input dimension and the number of classes , respectively . The prediction is given by arg maxi F ( x ) i . In the hierarchical classification framework , the classes are categorized ( e.g . by the user ) into fine classes and coarse classes 1 . The dataset consists of image and fine label pairs : { x , y } n. In the later , we use the set theory symbol ∈ to characterize the relationship between a fine and a coarse label : y ∈ z if the fine label y is part of the coarse class z . Note that this relation holds for both disjoint and overlapping coarse classes . Given an input data x , suppose its true coarse and fine labels are z∗ and y∗ respectively . Under the setting defined above , a hierarchical adversarial example must satisfy all the following properties : • the unperturbed input data x is correctly classified by the classifier : arg maxi F ( x ) i = y∗ ; • the perturbed data x′ = x+ δ is perceptually indistinguishable from the original input x ; • the perturbed data x′ is classified incorrectly : arg maxi F ( x′ ) i = y′ where y′ 6= y∗ ; • the misclassified label belongs to a different coarse class : y′ 6∈ z∗ . Notice that satisfying the first three properties is sufficient to define a standard adversarial examples , and that hierarchical adversarial examples are special cases of adversarial examples . It is worth mentioning that measuring perceptual distance can be difficult ( Li et al. , 2003 ) , thus the second property is often replaced by limiting that the adversary can only modify any input x to x + δ with δ ∈ ∆ . Commonly used constraints are -balls w.r.t . ` p-norms , though other constraint sets have been used too ( Wong et al. , 2019 ) . In this work , we focus on ` ∞- and ` 2-norm attacks . 2.1 GENERATING HIERARCHICAL ADVERSARIAL PERTURBATIONS . A common class of attack techniques are gradient-based attacks , such as FGSM ( Goodfellow et al. , 2014 ) , BIM ( Kurakin et al. , 2016 ) and PGD ( Madry et al. , 2017 ) , that utilize gradient ( first-order ) information of the network to compute perturbations . Such methods are motivated by linearizing the loss function and solving for the perturbation that optimizes the loss subject to the ` p-norm constraint . Their popularity is largely due to its simplicity , because the optimization objective can be accomplished in closed form at the cost of one back-propagation . The main idea of gradient-based attacks can be summarized as follows . Given the prediction of F ( x ) and a target label y , the loss function of the model is denoted by ` ( x , y ) , ` ( F ( x ) , y ) , e.g. , a cross-entropy loss . Here , we omit the network parameter w in the loss because it is assumed to be fixed while generating adversarial perturbations . Note that the choice of y and whether to maximize or minimize the loss depend on if the attack is targeted or untargeted . For a targeted ` ∞ attack , gradient-based methods rely on the opposite direction of the loss gradient , − sign∇x ` ( x , y ) , to solve for the perturbation that minimizes the loss with respect to a non-true target label ( y 6= y∗ ) . Despite its simplicity , gradient-based attacks are highly effective at finding ` p-bounded perturbations that lead to misclassifications . In our work , we introduce a simple variant of the projected gradient descent ( PGD ) adversary to find hierarchical adversarial examples . Given an input image with true coarse and fine labels z∗ and y∗ respectively . Let xj denote the perturbed input at iteration j , we define : xj+1 = ΠB∞ ( x , ) { xj − α sign ( ∇x ` ( xj , ŷ ) ) } ( 1 ) where the target label ŷ comes from a different coarse class : ŷ 6∈ z∗ . Algorithm 1 summarize the procedures for generating an ` ∞-constrained hierarchical adversarial examples . The projection operator Π after each iteration ensures that the perturbation is in an -neighbourhood of the original image . We also adopt the random initialization in PGD attacks ( Madry et al. , 2017 ) : x0 = x + η , where η = ( η1 , η2 , . . . , ηd ) > and ηi ∼ U ( − , ) . There are several approaches to choose the target class ( Carlini & Wagner , 2017 ) . The target class can be chosen in an average-case approach where the class is selected uniformly at random among all eligible labels . Alternatively , they can be chosen in a strategic way , a best-case attack , to find the target class which requires the least number of PGD iterations for misclassifications . In our work , we consider a worst-case attack by iterating through all candidate target labels , i.e. , fine labels that 1We could go beyond this 2-level hierarchy . Here we keep the presentation simple for didactic purposes . Algorithm 1 : A worst-case approach for generating ` ∞-bounded hierarchical adversarial example based on a targeted PGD attack . Input : A pair of input data ( x , y∗ ) , where fine label y∗ belongs to the coarse label z∗ ; a neural network F ( · ) ; loss function ` ( · ) ; ` ∞ constraint of ; number of PGD iterations k ; PGD step-size α . 1 Define S = { y | y 6∈ z∗ } , a collection of all fine labels that do not belong in the coarse label z∗ ; 2 for ŷ ∈ S do 3 x0 ← x+ η , where η ← ( η1 , η2 , . . . , ηd ) > and ηi ∼ U ( − , ) . 4 for j = 0 , . . . , k − 1 do 5 xj+1 = ΠB∞ ( x , ) { xj − α sign ( ∇x ` ( xj , ŷ ) ) } where Π is the projection operator . 6 end 7 if arg maxi F ( xk ) i = ŷ then 8 Terminate ( successful attack ) ; 9 else 10 S \ ŷ ; 11 if S is empty then 12 Terminate ( failed attack ) ; 13 end 14 end 15 end do not belong in the same coarse class . This iterative targeted attack process terminates under two conditions : 1. perturbation results in a successful targeted misclassification ; 2. all candidate fine labels have been used as targets .

Summary: This paper investigates adversarial attacks in the hierarchy of labels. Misclassifying a person for a car is a “coarse misclassification”, but misclassifying a bus for a car is a “fine misclassification”. The paper introduces both a metric for hierarchical adversarial robustness, and a method to improve this metric (which is a hierarchical formulation of resnet architectures).