Adversarial Robustness Against the Union of Multiple Perturbation Models

1 INTRODUCTION . Machine learning algorithms have been shown to be susceptible to adversarial examples ( Szegedy et al. , 2014 ) through the existence of data points which can be adversarially perturbed to be misclassified , but are “ close enough ” to the original example to be imperceptible to the human eye . Methods to generate adversarial examples , or “ attacks ” , typically rely on gradient information , and most commonly use variations of projected gradient descent ( PGD ) to maximize the loss within a small perturbation region , usually referred to as the adversary ’ s threat model . Since then , a number of heuristic defenses have been proposed to defend against this phenomenon , e.g . distillation ( Papernot et al. , 2016 ) or more recently logit-pairing ( Kannan et al. , 2018 ) . However , as time goes by , the original robustness claims of these defenses typically don ’ t hold up to more advanced adversaries or more thorough attacks ( Carlini & Wagner , 2017 ; Engstrom et al. , 2018 ; Mosbach et al. , 2018 ) . One heuristic defense that seems to have survived ( to this day ) is to use adversarial training against a PGD adversary ( Madry et al. , 2018 ) , which remains quite popular due to its simplicity and apparent empirical robustness . The method continues to perform well in empirical benchmarks even when compared to recent work in provable defenses , although it comes with no formal guarantees . Some recent work , however , pointed out that adversarial training against ` ∞ perturbations “ overfits ” to the ` ∞ threat model , and used this as motivation to propose a more complicated architecture in order to achieve robustness to multiple perturbation types on the MNIST dataset ( Schott et al. , 2019 ) . In this work , we offer a alternative viewpoint : while adversarial training can overfit to the individual threat models , we show that it is indeed possible to use adversarial training to learn a model which is simultaneously robust against multiple types of ` p norm bounded attacks ( we consider ` ∞ , ` 2 , and ` 1 attacks , but the approach can apply to more general attacks ) . First , we show while simple generalizations of adversarial training to multiple threat models can achieve some degree of robustness against the union of these threat models , the performance is inconsistent and converges to suboptimal tradeoffs which may not actually minimize the robust objective . Second , we propose a slightly modified PGD-based algorithm called multi steepest descent ( MSD ) for adversarial training which more naturally incorporates the different perturbations within the PGD iterates , further improving the adversarial training approach by directly minimizing the robust optimization objective . Third , we show empirically that our approach improves upon past work by being applicable to standard network architectures , easily scaling beyond the MNIST dataset , and outperforming past results on robustness against multiple perturbation types . 2 RELATED WORK . After their original introduction , one of the first widely-considered attacks against deep networks had been the Fast Gradient Sign Method ( Goodfellow et al. , 2015 ) , which showed that a single , small step in the direction of the sign of the gradient could sometimes fool machine learning classifiers . While this worked to some degree , the Basic Iterative Method ( Kurakin et al. , 2017 ) ( now typically referred to as the PGD attack ) was significantly more successful at creating adversarial examples , and now lies at the core of many papers . Since then , a number of improvements and adaptations have been made to the base PGD algorithm to overcome heuristic defenses and create stronger adversaries . Adversarial attacks were thought to be safe under realistic transformations ( Lu et al. , 2017 ) until the attack was augmented to be robust to them ( Athalye et al. , 2018b ) . Adversarial examples generated using PGD on surrogate models can transfer to black box models ( Papernot et al. , 2017 ) . Utilizing core optimization techniques such as momentum can greatly improve the attack success rate and transferability , and was the winner of the NIPS 2017 competition on adversarial examples ( Dong et al. , 2018 ) . Uesato et al . ( 2018 ) showed that a number of ImageNet defenses were not as robust as originally thought , and Athalye et al . ( 2018a ) defeated many of the heuristic defenses submitted to ICLR 2018 shortly after the reviewing cycle ended , all with stronger PGD variations . Throughout this cycle of attack and defense , some defenses were uncovered that remain robust to this day . The aforementioned PGD attack , and the related defense known as adversarial training with a PGD adversary ( which incorporates PGD-attacked examples into the training process ) has so far remained empirically robust ( Madry et al. , 2018 ) . Verification methods to certify robustness properties of networks were developed , utilizing techniques such as SMT solvers ( Katz et al. , 2017 ) , SDP relaxations ( Raghunathan et al. , 2018b ) , and mixed-integer linear programming ( Tjeng et al. , 2019 ) , the last of which has recently been successfully scaled to reasonably sized networks . Other work has folded verification into the training process to create provably robust networks ( Wong & Kolter , 2018 ; Raghunathan et al. , 2018a ) , some of which have also been scaled to even larger networks ( Wong et al. , 2018 ; Mirman et al. , 2018 ; Gowal et al. , 2018 ) . Although some of these could potentially be extended to apply to multiple perturbations simultaneously , most of these works have focused primarily on defending against and verifying only a single type of adversarial perturbation at a time . Last but most relevant to this work are adversarial defenses that attempt to be robust against multiple types of attacks simultaneously . Schott et al . ( 2019 ) used multiple variational autoencoders to construct a complex architecture for the MNIST dataset that is not as easily attacked by ` ∞ , ` 2 , and ` 0 adversaries . Importantly , Schott et al . ( 2019 ) compare to adversarial training with an ` ∞-bounded PGD adversary as described by Madry et al . ( 2018 ) , claiming that the adversarial training defense overfits to the ` ∞ metric , and they do not consider other forms of adversarial training . Following this , a number of concurrent papers have since been released . While not studied as a defense , Kang et al . ( 2019 ) study the transferability of adversarial robustness between models trained against different threat models . Croce & Hein ( 2019 ) propose a provable adversarial defense against all ` p norms for p ≥ 1 using a regularization term . Finally , Tramèr & Boneh ( 2019 ) study the theoretical and empirical trade-offs of adversarial robustness in various settings when defending against multiple adversaries , however , they use a rotation and translation adversary instead of an ` 2 adversary for CIFAR10 . Contributions In this work we demonstrate the effectiveness of adversarial training for learning models that are robust against a union of multiple perturbation models . First , we show that while simple aggregations of different adversarial attacks can achieve robustness against multiple perturbations models without resorting to complex architectures , the results are inconsistent across datasets and make suboptimal tradeoffs between the threat models . Second , we propose a modified PGD iteration that more naturally considers multiple perturbation models within the inner optimization loop of adversarial training . Third , we evaluate all approaches on the MNIST and CIFAR10 datasets , showing that our proposed generalizations of adversarial training can significantly outperform past approaches for the union of ` ∞ , ` 2 , and ` 1 attacks . Specifically , on MNIST , our model achieves 58.7 % ( individually 63.7 % , 82.6 % , 62.3 % ) adversarial accuracy against the union of all three attacks ( ` ∞ , ` 2 , ` 1 ) for = ( 0.3 , 1.5 , 12 ) respectively , substantially improving upon the multiple-perturbation-model robustness described in Schott et al . ( 2019 ) and also improving upon the simpler aggregations of multiple adversarial attacks . Unlike past work , we also train a CIFAR10 model , which achieves 46.1 % ( individually 47.6 % , 64.3 % , 53.4 % ) adversarial accuracy against the union of all three attacks ( ` ∞ , ` 2 , ` 1 ) for = ( 0.03 , 0.5 , 12 ) . Finally , for completeness , we also draw relevant comparisons to concurrent work , and show that the relative advantage of our approach still holds . 3 OVERVIEW OF ADVERSARIAL TRAINING . Adversarial training is an approach to learn a classifier which minimizes the worst case loss within some perturbation region ( the threat model ) . Specifically , for some network fθ parameterized by θ , loss function ` , and training data { xi , yi } i=1 ... n , the robust optimization problem of minimizing the worst case loss within ` p norm-bounded perturbations with radius is min θ ∑ i max δ∈∆p , ` ( fθ ( xi + δ ) , yi ) , ( 1 ) where ∆p , = { δ : ‖δ‖p ≤ } is the ` p ball with radius centered around the origin . To simplify the notation , we will abbreviate ` ( fθ ( x+ δ ) , y ) = ` ( x+ δ ; θ ) . 3.1 SOLVING THE INNER OPTIMIZATION PROBLEM . We first look at solving the inner maximization problem , namely max δ∈∆p , ` ( x+ δ ; θ ) . ( 2 ) This is the problem addressed by the “ attackers ” in the space of adversarial examples , hoping that the classifier can be tricked by the optimal perturbed image , x+ δ ? . Typical solutions solve this problem by running a form of projected gradient descent , which iteratively takes steps in the gradient direction to increase the loss followed by a projection step back onto the feasible region , the ` p ball . Since the gradients at the example points themselves ( i.e. , δ = 0 ) are typically too small to make efficient progress , more commonly used is a variation called projected steepest descent . Steepest descent For some norm ‖ · ‖p and step size α , the direction of steepest descent on the loss function ` for a perturbation δ is vp ( δ ) = arg max ‖v‖p≤α vT∇ ` ( x+ δ ; θ ) . ( 3 ) Then , instead of taking gradient steps , steepest descent uses the following iteration δ ( t+1 ) = δ ( t ) + vp ( δ ( t ) ) . ( 4 ) In practice , the norm used in steepest descent is typically taken to be the same ` p norm used to define the perturbation region ∆p , . However , depending on the norm used , the direction of steepest descent can be quite different from the actual gradient ( Figure 1 ) . Note that a single steepest descent step with respect to the ` ∞ norm reduces to v∞ ( x ) = α · sign ( ∇ ` ( x+ δ ; θ ) ) , better known in the adversarial examples literature as the Fast Gradient Sign Method ( Goodfellow et al. , 2015 ) . Projections The second component of projected steepest descent for adversarial examples is to project iterates back onto the ` p ball around x . Specifically , projected steepest descent performs the following iteration δ ( t+1 ) = P∆p , ( δ ( t ) + vp ( δ ( t ) ) ) ( 5 ) where P∆p , ( δ ) is the standard projection operator that finds the perturbation δ′ ∈ ∆p , that is “ closest ” in Euclidean space to the input δ , defined as P∆p , ( δ ) = arg min δ′∈∆p , ‖δ − δ′‖22 . ( 6 ) Visually , a depiction of this procedure ( steepest descent followed by a projection onto the perturbation region ) for an ` 2 adversary can be found in Figure 1 . If we instead project the steepest descent directions with respect to the ` ∞ norm onto the ` ∞ ball of allowable perturbations , the projected steepest descent iteration reduces to δ ( t+1 ) = P∆∞ , ( δ ( t ) + v∞ ( δ ( t ) ) ) = clip [ − , ] ( δ ( t ) + α · sign ( ∇ ` ( x+ δ ( t ) ; θ ) ) ) ( 7 ) where clip [ − , + ] “ clips ” the input to lie within the range [ − , ] . This is exactly the Basic Iterative Method used in Kurakin et al . ( 2017 ) , typically referred to in the literature as an ` ∞ PGD adversary .

Summary: of the paper: The paper describes adversarial training aiming to build models that are robust to multiple adversarial attacks - with L_1, L_2 and L_inf norms.  The method is a based on adversarial training against a union of adversaries. That union is created by taking (projected) gradient steps like PGD (Kurakin 2017), but choosing the maximal loss over GD steps for L1, L2, L_inf at each step.