Self-ensemble Adversarial Training for Improved Robustness

1 INTRODUCTION . Deep learning techniques have showed promise in disciplines such as computer vision ( Krizhevsky et al. , 2012 ; He et al. , 2016 ) , natural language processing ( Vaswani et al. , 2017 ; Devlin et al. , 2019 ) , speech recognition ( DBL , 2012 ; Sak et al. , 2015 ) and even in protein structural modeling ( Si & Yan , 2021 ; Jumper et al. , 2021 ) . However , even for those efforts surpassing human-level performance in several fields ( Jia et al. , 2021 ; Gleave et al. , 2020 ; Xu et al. , 2019 ; 2018b ; Wang et al. , 2020a ) , deep learning based methods are vulnerable to adversarial examples generated by adding small adversarial perturbations to natural examples ( Szegedy et al. , 2014 ; Goodfellow et al. , 2015 ) . Following the discovery of this adversarial vulnerability , numerous defense approaches for protecting DNNs from adversarial attacks have been proposed ( Xu et al. , 2018a ; Liao et al. , 2018 ; Qin et al. , 2020 ; Papernot et al. , 2016 ; Ross & Doshi-Velez , 2018 ) . Because it is a straightforward and effective data-driven strategy , among these methods , adversarial training has become the de-facto way for strengthening the robustness of neural networks . The core of adversarial training is proactively inducing a robust model by forcing DNNs to learn adversarial examples generated from the current model , which helps DNNs gradually make up for their deficiencies . Therefore , it is a practical learning framework to alleviate the impact of adversarial attacks . As a saying goes , a person may go faster but a team can go farther . An ensemble of classifiers fused by output aggregates the collective wisdom of all participated classifiers , which outperform the decision made by a single classifier . Many ensemble methods ( Tramèr et al. , 2018 ; Pang et al. , 2019 ; Kurakin et al. , 2018 ) have shown their abilities to boost adversarial robustness . Despite averaged predictions of different models enables the aggregation against a large number of attacks , it is still a heavy computing burden to adversarially train all the member models . What is worse , the architectures and parameters of every member model , as well as their related contribution factors , should be safely saved and need performing forward propagation for every member repeatedly , which is a nightmare when dealing with massive components . Despite the fact that the ensemble technique adopts a variety of architectures and parameters , these models may have similar decision-making boundaries ( Tramèr et al. , 2017 ) . Therefore , it is natural to wonder : Could we develop the potential of the classifier itself to build a robust model rather than rely on multiple seemingly disparate classifiers ? Could we make use of states on the searching trajectory of optimization when performing adversarial training ? Motivated by these questions , we discuss the relationship between an ensemble of different classifiers fused by predictions and by parameters , and present a computation-friendly self-ensemble method named SEAT . In summary , this paper has the following contributions : • By rethinking the standard adversarial training and its variants , instead of developing a well-designed loss to find a single optimal in the weight space , we design an efficient algorithm called Self-Ensemble Adversarial Training ( SEAT ) by uniting states of every history model on the optimization trajectory through the process of adversarial training . Unlike the traditional ensemble technique , which is extremely time-consuming and repeating adversarial training procedures for individuals , SEAT simply requires training once . • We present a theoretical explanation of the differences between the two ensemble approaches discussed above and visualize the change of loss landscape caused by SEAT . Furthermore , while using data augmentation of external data can experimentally fix the deterioration during the late stages ( Gowal et al. , 2020 ; Rebuffi et al. , 2021 ) , we further investigate a subtle but fatal intrinsic issue in the general settings for the self-ensemble model , which causes the deterioration of the weight-ensembled method . • We thoroughly compare adversarial robustness of SEAT with other models trained by the state-of-the-art techniques against several attack methods on CIFAR-10 and CIFAR-100 datasets . Results have shown that the SEAT method itself can efficiently search in the weight space and significantly improve adversarial robustness . 2 REVIEW : STANDARD ADVERSARIAL TRAINING AND ITS SUCCESSORS . In this section , we first introduce basic concepts of adversarial training . Then we briefly review some variants and enhancements of standard adversarial training . 2.1 PRELIMINARIES . Consider a standard image task which involves classifying an input image into one of K classes , let x ∈ [ 0 , 1 ] n denote the input natural image and y ∈ { 1 , 2 , . . . , K } be the ground truth label , sampled from a distribution D. For adversarial attack , the goal of the adversary is to seek a malignant example in the vicinity of x , by adding a human imperceptible perturbation ε ∈ Rn . To exactly describe the meaning of “ imperceptible ” , this neighbor region Bε ( x ) anchored at x with apothem ε can be defined as Bε ( x ) = { ( x′ , y ) ∈ D | ‖x− x′‖ ≤ ε } . We also define a loss function : ` def = Θ × D → [ 0 , ∞ ) , which is usually positive , bounded , and upper-semi continuous ( Blanchet & Murthy , 2019 ; Villani , 2003 ; Bartlett & Mendelson , 2001 ) for all θ ∈ Θ . Instead of the original formulation of adversarial training ( Szegedy et al. , 2014 ; Goodfellow et al. , 2015 ) , which mixes natural examples x and adversarial examples x′ together to train models , the adversarial risk minimization problem can be formulated as a two-player game that writes as below : inf θ∈Θ E ( x , y ) ∼D︸ ︷︷ ︸ Outer minimization sup x′∈Bε ( x ) ` ( θ ; x′ , y ) ︸ ︷︷ ︸ Inner maximization . ( 1 ) In general , the adversary player iteratively computes more and more harmful perturbations step by step , where the PGD method ( Madry et al. , 2018 ) is commonly applied : xt+1 = ΠB ( x , ) ( xt + κ sign ( ∇x ` ( x , y ) ) ) , ( 2 ) where κ is the step size and the generated samples at each iteration will be projected back to the Bε ( x ) . When finding x′ at their current optimal in the inner maximization , the model parameters will be updated according to these fixed samples only in the outer minimization . 2.2 RELATED WORK . Emerging adversarial training methods are primarily concerned with strengthening their robustness through empirical defense . Here we roughly separate these improvements into two categories : ( 1 ) sample-oriented ( i.e . for x′ in the inner maximization ) and ( 2 ) loss-oriented ( i.e . for ` in the outer minimization ) improvement . From the side of the former , Baluja & Fischer ( 2017 ) utilize a GAN framework to create adversarial examples via the generative model while FAT ( Zhang et al. , 2020 ) proposes a PGD-based method which control the length of searching trajectories of PGD through the lens of geometry . For the latter , a stream of works have been carried out with the goal of establishing a new supervised loss for better optimization . Usually , the loss ` in the both inner maximization and outer minimization1 are cross-entropy ( Good , 1956 ) defined as : ` ce = −yT log q when given the probability vector q = [ efθ ( x ′ ) 1 , · · · , efθ ( x′ ) c ] / ∑c k=1 e fθ ( x ′ ) k . The addition of a regularizer to the vanilla loss is one branch of the modification . Representative works like ALP ( Kannan et al. , 2018 ) , TRADES ( Zhang et al. , 2019 ) , and VAT ( Miyato et al. , 2019 ) introduce a regularization term to smooth the gap between the probability output of natural examples and adversarial ones , which can be denoted as : ` reg = ` ce + η ∑ ( xi , yi ) ∼B R ( p ( θ ; x′i , yi ) , p ( θ ; xi , yi ) ) , ( 3 ) where η is the regularization hyper-parameter and R ( · , · ) is l2 distance for ALP and VAT2 , and Kullback-Leibler divergence for TRADES . B stands for the sampled minibatch . Another branch of the loss modification is to reweight the contributions of each instance in the minibatch based on their intrinsic characteristics . This can be formulated by : ` rew = ∑ ( xi , yi ) ∼B w ( θ ; xi , x ′ i , yi ) ` ce ( θ ; xi , x ′ i , yi ) , ( 4 ) where w ( · ) is a real-valued function mapping the input instances to an importance score . MMA ( Ding et al. , 2020 ) separately considers the correct and incorrect classification on natural cases and switches between them by learning a hard importance weight : ` MMA = ∑ ( xi , yi ) ∼B w1 ( θ ; xi , yi ) ` ce ( θ ; xi , yi ) + w2 ( θ ; xi , yi ) ` ce ( θ ; x ′ i , yi ) , ( 5 ) where w1 and w2 are the indicator function 1 ( fθ ( xi ) 6= yi ) and 1 ( fθ ( xi ) = yi ) , respectively . Inspired by the geometry concern of FAT , GAIRAT ( Zhang et al. , 2021 ) evaluates w ( θ ; x , y ) = ( 1 + tanh ( c1 − 10c2 + 5 ) ) /2 to adaptively control the contribution of different instances by their corresponding geometric distance of PGD , where c1 is a hyper-parameter and c2 is the ratio of the minimum successful iteration numbers of PGD to the maximum iteration step . Embracing both two schools of improvement , MART ( Wang et al. , 2020b ) adds a new regularization term apart from KL divergence and explicitly assigns weights within regularizers : ` MART = ` ce + ∑ ( xi , yi ) ∼B w ( θ ; xi , yi ) RKL ( p ( θ ; x′i , yi ) , p ( θ ; xi , yi ) ) +Rmag ( p ( θ ; x′i , yi ) ) , ( 6 ) whereRKL is Kullback-Leibler divergence same as TRADES and wi = ( 1− p ( θ ; xi , yi ) ) is a softer scheme when compared with MMA . The margin termRmag = − log ( 1−maxk 6=yi pk ( θ ; x′i , yi ) ) aims at improving the decision boundary . The above methods endeavor to solve the highly non-convex and non-concave optimization in Eqn 1 . However , they assume that the optimal weights of a classifier appear in its prime and abandon all the states along the route of optimization , which are beneficial to approach the optimal .

Summary: This paper proposes the Self-Ensemble Adversarial Training (SEAT) which averages weights of history models for robustness. Compared to individual models or an ensemble of predictions from different classifiers, they argue that the proposed self-ensemble method provides a smoother loss landscape and better robustness. They also shed light on the deterioration of general self-ensemble models because of learning rates in the late phases.