Improving Hierarchical Adversarial Robustness of Deep Neural Networks

1 INTRODUCTION . Deep neural networks ( DNNs ) are highly vulnerable to attacks based on small modification of the input to the network at test time ( Szegedy et al. , 2013 ) . Those adversarial perturbations are carefully crafted in a way that they are imperceptible to human observers , but when added to clean images , can severely degrade the accuracy of the neural network classifier . Since their discovery , there has been a vast literature proposing various attack and defence techniques for the adversarial settings ( Szegedy et al. , 2013 ; Goodfellow et al. , 2014 ; Kurakin et al. , 2016 ; Madry et al. , 2017 ; Wong et al. , 2020 ) . These methods constitute important first steps in studying adversarial robustness of neural networks . However , there exists a fundamental flaw in the way we assess a defence or an attack mechanism . That is , we overly generalize the mistakes caused by attacks . Particularly , the current approaches focuses on the scenario where different mistakes caused by the attacks are treated equally . We argue that some context do not allow mistakes to be considered equal . In CIFAR-100 ( Krizhevsky et al. , 2009 ) , it is less problematic to misclassify a pine tree as a oak tree than a fish as a truck . As such , we are motivated to propose the concept of hierarchical adversarial robustness to capture this notion . Given a dataset whose classes can be grouped into coarse labels , we define hierarchical adversarial examples as the ones leading to a misclassification at the coarse level ; and we present a variant of the projected gradient descent ( PGD ) adversaries ( Madry et al. , 2017 ) to find hierarchical adversarial examples . Finally , we introduce a simple and principled hierarchical adversarially robust ( HAR ) network which decompose the end-to-end robust learning task into a single classification task into one coarse and multiple fine classification tasks , before being trained by adversarial defence techniques . Our contribution are • We introduce the concept of hierarchical adversarial examples : a special case of the standard adversarial examples which causes mistakes at the coarse level ( Section 2 ) . • We present a worst-case targeted PGD attack to find hierarchical adversarial examples . The attack iterates through all candidate fine labels until a successful misclassification into the desired target ( Section 2.1 ) . • We propose a novel architectural approach , HAR network , for improving the hierarchical ad- versarial robustness of deep neural networks ( Section 3 ) . We empirically show that HAR networks significantly improve the hierarchical adversarial robustness against ` ∞ attacks ( = 8255 ) ( Section 4 ) and ` 2 attacks ( = 0.5 ) ( Appendix A.4 ) on CIFAR-100 . • We benchmark using untargeted PGD20 attacks as well as the proposed iterative targeted PGD attack . In particular , we include an extensive empirical study on the improved hierarchical robustness of HAR by evaluating against attacks with varying PGD iterations and . We find that a vast majority of the misclassifications from the untargeted attack are within the same coarse label , resulting a failed hierarchical attack . The proposed iterative targeted attacks provides a better empirical representation of the hierarchical adversarial robustness of the model ( Section 4.2 ) . • We show that the iterative targeted attack formulated based on the coarse network are weaker hierarchical adversarial examples compared to the ones generated using the entire HAR network ( Section 4.3 ) . 2 HIERARCHICAL ADVERSARIAL EXAMPLES . The advancement in DNN image classifiers is accompanied by the increasing complexity of the network design ( Szegedy et al. , 2016 ; He et al. , 2016 ) , and those intricate networks has provided state-of-the-art results on many benchmark tasks ( Deng et al. , 2009 ; Geiger et al. , 2013 ; Cordts et al. , 2016 ; Everingham et al. , 2015 ) . Unfortunately , the discovery of adversarial examples has revealed that neural networks are extremely vulnerable to maliciously perturbed inputs at test time ( Szegedy et al. , 2013 ) . This makes it difficult to apply DNN-based techniques in mission-critical and safetycritical areas . Another important develeopment along with the advancement of DNN is the growing complexity of the dataset , both in size and in number of classes : i.e . from the 10-class MNIST dataset to the 1000-class ImageNet dataset . As the complexity of the dataset increases exponentially , dataset can often be divided into several coarse classes where each coarse class consists of multiple fine classes . In this paper , we use the term label and class interchangeably . The concept of which an input image is first classified into coarse labels and then into fine labels are referred to as hierarchical classification ( Tousch et al. , 2012 ) . Intuitively , the visual separability between groups of fine labels can be highly uneven within a given dataset , and thus some coarse labels are more difficult to distinguish than others . This motivates the use of more dedicated classifiers for specific groups of classes , allowing the coarse labels to provide information on similarities between the fine labels at an intermediate stage . The class hierarchy can be formed in different ways , and it can be learned strategically for optimal performance of the downstream task ( Deng et al. , 2011 ) . Note that it is also a valid strategy to create a customized class hierarchy and thus be able to deal with sensitive missclassification . To illustrate our work , we use the predefined class hierarchy of the CIFAR-10 and the CIFAR-100 dataset ( Krizhevsky et al. , 2009 ) : fine labels are grouped into coarse labels by semantic similarities . All prior work on adversarial examples for neural networks , regardless of defences or attacks , focuses on the scenario where all misclassifications are considered equally ( Szegedy et al. , 2013 ; Goodfellow et al. , 2014 ; Kurakin et al. , 2016 ; Madry et al. , 2017 ; Wong et al. , 2020 ) . However , in practice , this notion overly generalizes the damage caused by different types of attacks . For example , in an autonomous driving system , confusing a perturbed image of a traffic sign as a pedestrian should not be treated the same way as confusing a bus as a pickup truck . The former raises a major security threat for practical machine learning applications , whereas the latter has very little impact to the underlying task . Moreover , misclassification across different coarse labels poses potential ethical concerns when the dataset involves sensitive features such as different ethnicities , genders , people with disabilities and age groups . Mistakes across coarse classes leads to much more severe consequences compared to mistakes within coarse classes . As such , to capture this different notion of attacks , we propose the term hierarchical adversarial examples . They are a specific case of adversarial examples where the resulting misclassification occurs between fine labels that come from different coarse labels . Here , we provide a clear definition of the hierarchical adversarial examples to differentiate it from the standard adversarial examples . We begin with the notation for the classifier . Consider a neural network F ( x ) : Rd → Rc with a softmax as its last layer ( Hastie et al. , 2009 ) , where d and c denote the input dimension and the number of classes , respectively . The prediction is given by arg maxi F ( x ) i . In the hierarchical classification framework , the classes are categorized ( e.g . by the user ) into fine classes and coarse classes 1 . The dataset consists of image and fine label pairs : { x , y } n. In the later , we use the set theory symbol ∈ to characterize the relationship between a fine and a coarse label : y ∈ z if the fine label y is part of the coarse class z . Note that this relation holds for both disjoint and overlapping coarse classes . Given an input data x , suppose its true coarse and fine labels are z∗ and y∗ respectively . Under the setting defined above , a hierarchical adversarial example must satisfy all the following properties : • the unperturbed input data x is correctly classified by the classifier : arg maxi F ( x ) i = y∗ ; • the perturbed data x′ = x+ δ is perceptually indistinguishable from the original input x ; • the perturbed data x′ is classified incorrectly : arg maxi F ( x′ ) i = y′ where y′ 6= y∗ ; • the misclassified label belongs to a different coarse class : y′ 6∈ z∗ . Notice that satisfying the first three properties is sufficient to define a standard adversarial examples , and that hierarchical adversarial examples are special cases of adversarial examples . It is worth mentioning that measuring perceptual distance can be difficult ( Li et al. , 2003 ) , thus the second property is often replaced by limiting that the adversary can only modify any input x to x + δ with δ ∈ ∆ . Commonly used constraints are -balls w.r.t . ` p-norms , though other constraint sets have been used too ( Wong et al. , 2019 ) . In this work , we focus on ` ∞- and ` 2-norm attacks . 2.1 GENERATING HIERARCHICAL ADVERSARIAL PERTURBATIONS . A common class of attack techniques are gradient-based attacks , such as FGSM ( Goodfellow et al. , 2014 ) , BIM ( Kurakin et al. , 2016 ) and PGD ( Madry et al. , 2017 ) , that utilize gradient ( first-order ) information of the network to compute perturbations . Such methods are motivated by linearizing the loss function and solving for the perturbation that optimizes the loss subject to the ` p-norm constraint . Their popularity is largely due to its simplicity , because the optimization objective can be accomplished in closed form at the cost of one back-propagation . The main idea of gradient-based attacks can be summarized as follows . Given the prediction of F ( x ) and a target label y , the loss function of the model is denoted by ` ( x , y ) , ` ( F ( x ) , y ) , e.g. , a cross-entropy loss . Here , we omit the network parameter w in the loss because it is assumed to be fixed while generating adversarial perturbations . Note that the choice of y and whether to maximize or minimize the loss depend on if the attack is targeted or untargeted . For a targeted ` ∞ attack , gradient-based methods rely on the opposite direction of the loss gradient , − sign∇x ` ( x , y ) , to solve for the perturbation that minimizes the loss with respect to a non-true target label ( y 6= y∗ ) . Despite its simplicity , gradient-based attacks are highly effective at finding ` p-bounded perturbations that lead to misclassifications . In our work , we introduce a simple variant of the projected gradient descent ( PGD ) adversary to find hierarchical adversarial examples . Given an input image with true coarse and fine labels z∗ and y∗ respectively . Let xj denote the perturbed input at iteration j , we define : xj+1 = ΠB∞ ( x , ) { xj − α sign ( ∇x ` ( xj , ŷ ) ) } ( 1 ) where the target label ŷ comes from a different coarse class : ŷ 6∈ z∗ . Algorithm 1 summarize the procedures for generating an ` ∞-constrained hierarchical adversarial examples . The projection operator Π after each iteration ensures that the perturbation is in an -neighbourhood of the original image . We also adopt the random initialization in PGD attacks ( Madry et al. , 2017 ) : x0 = x + η , where η = ( η1 , η2 , . . . , ηd ) > and ηi ∼ U ( − , ) . There are several approaches to choose the target class ( Carlini & Wagner , 2017 ) . The target class can be chosen in an average-case approach where the class is selected uniformly at random among all eligible labels . Alternatively , they can be chosen in a strategic way , a best-case attack , to find the target class which requires the least number of PGD iterations for misclassifications . In our work , we consider a worst-case attack by iterating through all candidate target labels , i.e. , fine labels that 1We could go beyond this 2-level hierarchy . Here we keep the presentation simple for didactic purposes . Algorithm 1 : A worst-case approach for generating ` ∞-bounded hierarchical adversarial example based on a targeted PGD attack . Input : A pair of input data ( x , y∗ ) , where fine label y∗ belongs to the coarse label z∗ ; a neural network F ( · ) ; loss function ` ( · ) ; ` ∞ constraint of ; number of PGD iterations k ; PGD step-size α . 1 Define S = { y | y 6∈ z∗ } , a collection of all fine labels that do not belong in the coarse label z∗ ; 2 for ŷ ∈ S do 3 x0 ← x+ η , where η ← ( η1 , η2 , . . . , ηd ) > and ηi ∼ U ( − , ) . 4 for j = 0 , . . . , k − 1 do 5 xj+1 = ΠB∞ ( x , ) { xj − α sign ( ∇x ` ( xj , ŷ ) ) } where Π is the projection operator . 6 end 7 if arg maxi F ( xk ) i = ŷ then 8 Terminate ( successful attack ) ; 9 else 10 S \ ŷ ; 11 if S is empty then 12 Terminate ( failed attack ) ; 13 end 14 end 15 end do not belong in the same coarse class . This iterative targeted attack process terminates under two conditions : 1. perturbation results in a successful targeted misclassification ; 2. all candidate fine labels have been used as targets .

Summary: The authors discuss a new notion of adversarial robustness, specifically, robustness to hierarchical adversarial examples. This is motivated by the idea that some types of misclassifications (e.g. mistaking one type of dog for another) may be less harmful than others (e.g. mistaking a dog for a truck); thus, adversarial examples will be more harmful if they cause coarse-grained errors as opposed to fine-grained ones. The authors further propose a network architecture that is designed to be more robust in the hierarchical sense, and they provide some experimental evidence comparing their methodology to standard adversarially trained networks.