Don't let your Discriminator  be fooled

1 INTRODUCTION . Generative adversarial networks ( GANs ) ( Goodfellow et al. , 2014a ) are at the forefront of generative modeling . They cast generative modeling as a never ending duel between two networks : a generator network produces synthetic samples from random noise and a discriminator network distinguishes synthetic from real data samples . GANs produce visually appealing samples , but are often hard to train . Much recent work , tries to stabilize GAN training through novel architecture ( Radford et al. , 2015 ; Denton et al. , 2015 ) or training objectives ( Mao et al. , 2017 ; Arjovsky et al. , 2017 ; Gulrajani et al. , 2017 ) . In this paper , we show that GAN objectives significantly stabilize , if the discriminator is robust to adversarial attacks . Specifically , we show that a robust discriminator leads to a robust minimax objective for the generator irrespective of the training objective used . In addition , any training objective is smooth and Lipschitz as long as the discriminator is Lipschitz . Finally , we show that this robustness does not need to be enforced for every single input of the discriminator , but rather just in expectation over the generated samples . We present two new regularization terms , borrowed from the adversarial training literature . Both terms ensure the robustness of the discriminator . They are easy to optimize and can be added to any existing GAN objective . Our experiments show that adversarial robustness both improves the visual quality of the results , as well as stabilizes the training procedure across a wide range of architectures , hyper-parameters and training objectives . We will publish the code and data used to perform our experiments upon acceptance . 2 RELATED WORKS . The scope of generative modeling changed significantly with the emergence of photo realistic image generation like Generative Adversarial Networks ( GANs ) ( Goodfellow et al. , 2014a ) , Variational AutoEncoders ( Kingma & Welling , 2013 ) , or Pixel Convolutional Networks ( Oord et al. , 2016 ) . The visual quality of these generative models enabled applications such as , generative image processing ( Pathak et al. , 2016 ) , image editing ( Zhu et al. , 2016 ) , and image translation ( Isola et al. , 2017 ; Zhu et al. , 2017 ) . They also started the race for ever prettier generated images . Two major areas of improvement are architectures ( Radford et al. , 2015 ; Denton et al. , 2015 ) and loss functions ( Mao et al. , 2017 ; Arjovsky et al. , 2017 ; Gulrajani et al. , 2017 ) . Denton et al . ( 2015 ) showed that a Laplacian pyramid generator greatly improves the quality of the generated images , while Radford et al . ( 2015 ) showed impressive results by carefully balancing the expressive power of the generator and discriminator networks . In this work , we use Radford et al . ( Radford et al. , 2015 ) architecture , and solely focus on the loss function . GANs come in three popular loss functions : the original Jensen-Shanon divergence objective ( Goodfellow et al. , 2014a ) , least squares GANs ( LSGAN ) ( Mao et al. , 2017 ) , and Wasserstein distance ( WGAN ) ( Arjovsky et al. , 2017 ) . Each objectives minimizes special case of a f-divergence between the generative and data distribution ( Nowozin et al. , 2016 ) . Arjovsky et al . ( 2017 ) augment the GAN objective with a smoothness condition in the form of a Lipschitz-1 constraint on the discriminator . However , enforcing a Lipschitz-1 discriminator is difficult . Arjovsky et al . ( 2017 ) clip the weights of the discriminator to enforce the Lipschitz condition , while Gulrajani et al . ( 2017 ) apply a penalty on the gradient of the discriminator . The gradient penalty ( WGAN-GP ) generally yields better results , however it looses some of the appealing theoretical properties of WGANs . Arjovsky et al.show that in theory most GAN objective are non-continuous and non-Lipschitz , while the Wasserstein objective is Lipschitz , smooth , and more stable to optimize . In this paper , we extend their analysis and show that any GAN objective can be made smooth as long as the discriminator is robust to adversarial perturbations . In addition , the discriminator only needs to be robust to adversarial attacks in expectation over all generated samples . A simple penalty function is sufficient to carry the theoretical smoothness results of WGAN other GAN objectives . Our theoretical analysis is related to Bottou et al . ( 2017 ) , who study the geometry to common distance measures for generative modeling . We build on their analysis and show that any GAN objective is Lipschitz and smooth , as long as the generator and discriminator are Lipschitz . Adversarial Examples Despite success of deep networks , their differentiable nature makes them vulnerabilities to adversarial attacks . Small perturbation of the input can significantly change the output of a network ( Szegedy et al. , 2013 ) . The initial work of Szegedy et al . ( 2013 ) set off an arms race between novel attack methods ( Goodfellow et al. , 2014b ; Carlini & Wagner , 2017 ; Papernot et al. , 2016a ; Moosavi Dezfooli et al. , 2016 ) and defenses ( Kannan et al. , 2018 ; Papernot et al. , 2016b ) against these attacks . The goal of an attacker is to find an perturbation in an attack region that yields a large change in output . Some of the fastest attacks simply perturb the input in the gradient direction of the network ( Goodfellow et al. , 2014b ) , while more complex attacks optimize for an attack vector ( Carlini & Wagner , 2017 ) . Many attacks can be directly used in a defense through dataset augmentation ( Papernot et al. , 2016b ) . In this work , we primarily use the fast gradient methods of Goodfellow et al . ( 2014b ) , in particular we use the normalized gradient attack . 3 PRELIMINARIES . Let z ∼ PZ be a sample from a noise distribution PZ , e.g . uniform noise . Let x ∼ PR be a sample form a data distribution PR . The goal of sampling based generative modeling is to find a function G ( z ) that maps samples from PZ to PR . More specifically , we want PY = { y = G ( z ) |z ∼ PZ } to closely resemble PR . Generative Adversarial Networks A generative adversarial network ( GAN ) optimizes a two player game between a generative model G and a discriminator D. The generator G maps noise to data samples . A discriminator D then judges if the transformed noise is close enough to the true data distribution PR . A GAN jointly optimizes both generator and discriminator in a minimax game . The GAN objective L minimizes a generator G and maximizes a discriminator D over L ( G , D ) = Ex∼PR [ f ( −D ( x ) ) ] + Ez∼PZ [ f ( D ( G ( z ) ) ) ] , ( 1 ) where f is differentiable , usually concave , loss function . The generator minimizes ` ( G ) = max D∈D L ( G , D ) . ( 2 ) In practice , both generator G ( z ; θ ) and discriminator D ( x ; φ ) are deep neural networks with parameters θ and φ respectively . The discriminator D produces a single scalar output , which is then passed through the loss function f . Different choices of f lead to different GAN models . The original GAN objective uses a sigmoid log likelihood loss for f ( x ) = − log ( 1 + exp ( −x ) ) , and corresponds to the Jensen-Shannon divergence between data and generator ( Goodfellow et al. , 2014a ) . A Euclidean loss f ( x ) = − 12 ( 1 + x ) 2 leads to least squares GAN ( LSGAN ) ( Mao et al. , 2017 ) . A Lipschitz-1 discriminator D and identity loss functions f ( x ) = x corresponds to the Wasserstein distance in WGAN ( Arjovsky et al. , 2017 ) . In all these examples f is concave , and for GAN and LSGAN non-positive . Adversarial attacks We follow the standard adversarial attack definition in literature ( Carlini & Wagner , 2017 ; Kannan et al. , 2018 ) . Definition 3.1 ( robustness ) . A function h ( x ) is robust to adversarial perturbations ∆ for an input x if and only if |h ( x ) − h ( x+ ∆ ) | < ε for all ‖∆‖p < δ , where the p-norm ‖ · ‖p defines the local attack region . For simplicity of the analysis , we focus on distance norms | · | instead of general distance functions of Carlini & Wagner ( 2017 ) . Our definition includes logit pairing of Kannan et al . ( 2018 ) . Definition 3.1 focuses on individual inputs x drawn from an empirical data distribution of training or testing images . We extend this definition to generative distributions G ( z ) . Definition 3.2 ( expected robustness ) . A function h , e.g . a discriminator , is robust to adversarial perturbations for a generative distribution G ( z ) if and only if Ez∼PZ [ |h ( G ( z ) ) − h ( G ( z ) + u ( z ) ) | ] < ε for all functions u with‖u ( z ) ‖p < δ , where the p-norm ‖ · ‖p defines the local attack region , and d measures the distance between the network outputs . This definition only requires robustness in expectation , but not for every single sample z ∼ PZ . A discriminator D is robust if it satisfies definition 3.2 for h = D. A discriminator loss f is robust for h = f ◦D . For notational simplicity , we define the additive combination of a generator G and a perturbation function u as G+ u where ( G+ u ) ( z ) = G ( z ) + u ( z ) . 4 ROBUST GENERATIVE ADVERSARIAL NETWORKS . In this section , we show that the GAN objective is robust to adversarial perturbations , as long as the discriminator is robust . This property even holds as the discriminator adapts with the perturbation applied . We first analyze the case when the loss of the discriminator is robust to an adversarial attack , and then study the robustness of the discriminator directly . Theorem 4.1 ( robust loss ) . If the loss of a discriminator D is robust to adversarial perturbations ‖u ( z ) ‖p < δ in expectation Ez∼PZ [ |f ( D ( G ( z ) ) ) − f ( D ( G ( z ) + u ( z ) ) ) | ] < ε then the adversarial objective ` is robust | ` ( G ) − ` ( G+ u ) | < ε Proof . Let DG be the optimal discriminator for generator G. For this discriminator we have L ( G , DG ) = max D L ( G , D ) ≥ L ( G , DG+u ) , ( 3 ) by definition . This allows us to bound the difference in the objective for a generator G and its perturbation G+ u : ` ( G ) − ` ( G+ u ) ≤ L ( G , DG ) − L ( G+ u , DG ) Inequality 3 = Ez∼µz [ f ( DG ( G ( z ) ) ) − f ( DG ( G ( z ) + u ( z ) ) ) ] < ε linearity of expectation We can equivalently bound ` ( G+ u ) − ` ( G ) < ε , and obtain | ` ( G ) − ` ( G+ u ) | < ε . The above proof uses the ( global ) optimality of the discriminator in Equation ( 3 ) . However , the bound holds for any discriminator that improves the objective , without reaching a local or global minima , and could thus be generalized . Next , we focus our attention to robust discriminators . Here , we rely on an additional assumption that all loss functions f we consider are concave . This is the case for the three most popular architectures : original GAN , LSGAN and WGAN . Theorem 4.2 ( robust discriminator ) . For a concave loss f and a discriminator D that is robust to perturbations ‖u ( z ) ‖p < δ in expectation Ez∼PZ [ |D ( G ( z ) ) −D ( G ( z ) + u ( z ) ) | ] < ε the adversarial objective ` is robust | ` ( G ) − ` ( G+ u ) | < εC where C = Ez∈PZ [ max ( |f ′ ( D ( G ( z ) ) ) | , |f ′ ( D ( G ( z ) + u ( z ) ) ) | ) ] is the expected loss gradient . Proof . The proof follows directly from the definition of concavity f ( a ) − f ( b ) ≤ f ′ ( a ) ( a− b ) and the fairly conservative bound |f ( a ) −f ( b ) | ≤ max ( |f ′ ( a ) | , |f ′ ( b ) | ) |a−b| . In expectation , this bound reduces the robust discriminator to a robust loss Ez∼PZ [ |f ( D ( G ( z ) ) ) − f ( D ( G ( z ) + u ( z ) ) ) | ] ≤ Ez∼PZ [ |D ( G ( z ) ) −D ( G ( z ) + u ( z ) ) | ] C < εC . The rest of the proof follows Theorem 4.1 . For the original GAN C < 1 , for WGAN C = 1 , and for LSGAN C ≤ Ez∈PZ [ |1 +D ( G ( z ) ) | ] + ε , where |1 +D ( G ( z ) ) | is directly minimized in the objective and is close to zero . Theorem 4.1 and Theorem 4.2 have some interesting implications for general GANs . First , any GAN that is trained with a robust discriminator or loss has a robust and hence smooth objective . This directly extends the theoretical properties of WGANs ( Arjovsky et al. , 2017 ) to other GAN model . It further relaxes the strict Lipschitz constraints to adversarial robustness in expectation . This is much easier to enforce in practice as we will show in the next section . Second , Theorem 4.2 allows us to analyze the continuity and Lipschitzness of any GAN objective . In particular , we can show any GAN objective is continuous or Lipschitz in its parameters as long as the discriminator and generator are continuous or Lipschitz . This is in direct contradiction to Arjovsky et al . ( 2017 ) , that show only WGAN to be continuous . However , their counter example relies on a discontinuous discriminator with infinitely large weights . See supplemental material for a detailed derivation and proof . Robust discriminators or losses can be hard to train in practice , as they require constrained optimization or a carefully tuned architecture . Next , we show how a regularized discriminator objective can lead to a robust discriminator without the need for any constraints .

Summary: This paper proposes a new way to stabilize the training process of GAN by regularizing the Discriminator to be robust to adversarial examples. Specifically, this paper proves that a discriminator which is robust to adversarial attacks also leads to a robust minimax objects. Authors provide theoretical analysis about the how the robustness of the Discriminator affects the properties of the objective function, and the proposed regularization term provides an efficient and effective way to regularize the discriminator to be robust. However, it does not build connection between the robustness of the Discriminator and why it can provide meaningful gradient to the Generator. Experimental results demonstrate the effectiveness of the proposed method. This paper is easy to understand.